Transcribed
Microsoft Defender for Identity - Simply Explained
Jul 22, 2026 ·
15m
Download and listen anywhere
Download your favorite episodes and enjoy them, wherever you are! Sign up or log in now to access offline listening.
Microsoft Defender for Identity - Simply Explained
Description
Attackers no longer break in - they log in with stolen credentials, and traditional security tools never notice. This episode explains how Microsoft Defender for Identity watches your on-premises Active...
show more
Attackers no longer break in - they log in with stolen credentials, and traditional security tools never notice. This episode explains how Microsoft Defender for Identity watches your on-premises Active Directory with sensors and behavioral analytics. Security and IT admins learn which attacks it catches and how honeytokens and Defender XDR make it even stronger.
In this episode
Key takeaways
Worth quoting
“Attackers don't break in, they just log in, they scoop up a legitimate password through phishing, a data breach, or a simple guess, and then stroll right through the front door.” – Mirko Peters (00:59)
“Microsoft Defender for Identity is a cloud-based security tool that watches your on-premises active directory for identity-based attacks.” – Mirko Peters (02:17)
Explore more on M365.FM
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
show less
In this episode
- 00:00 – Stolen passwords, not broken firewalls
- 00:35 – The identity security problem
- 02:14 – What Defender for Identity is
- 04:01 – Sensors and behavioral analytics
- 06:37 – The attack lifecycle it catches
- 08:22 – Alerts, incidents and actions
- 10:53 – Honeytokens, tagging and exclusions
- 12:44 – Place in the Defender XDR ecosystem
Key takeaways
- Defender for Identity detects identity-based attacks on on-premises Active Directory by learning normal user behavior and flagging deviations rather than scanning for malware.
- Lightweight sensors on domain controllers feed a cloud service that detects reconnaissance, pass-the-hash, Kerberoasting, golden tickets, DCSync and lateral movement mapped to MITRE ATT&CK.
- Combined with Defender for Endpoint, Defender for Office 365, Sentinel and Entra ID Protection inside Defender XDR, its alerts become complete attack stories.
Worth quoting
“Attackers don't break in, they just log in, they scoop up a legitimate password through phishing, a data breach, or a simple guess, and then stroll right through the front door.” – Mirko Peters (00:59)
“Microsoft Defender for Identity is a cloud-based security tool that watches your on-premises active directory for identity-based attacks.” – Mirko Peters (02:17)
Explore more on M365.FM
- Episode page: the full episode with chapters, quotes and FAQ on identity threat detection
- Microsoft Defender for Identity – the episode's subject, combining domain controller sensors with behavioral analytics in the cloud
- Active Directory – the on-premises directory that Defender for Identity monitors for identity-based attacks
- Microsoft Defender – Defender XDR correlates Defender for Identity alerts with endpoint and email signals into incidents
- Related episode: Microsoft Entra Connect - Simply Explained
Follow and rate M365.FM in your podcast app, and join the free M365 community at m365con.net.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-microsoft-365-azure-cloud-power-platform-ai--6704921/support.
Information
| Author | Mirko Peters M365, Azure & AI |
| Organization | m365 FM |
| Website | www.m365.fm |
| Tags |
Copyright 2026 - Spreaker Inc. an iHeartMedia Company
Comments