Microsoft Defender for Identity
Identity protectionEntity tags in Microsoft Defender for Identity
In brief
The article now uses Microsoft Defender terminology, clarifies sensitive, Exchange server, and honeytoken tagging guidance, and notes that Entra ID and SailPoint Identity Security Cloud roles are used for sensitive entity tagging.
What Defender admins need to know
Administrators managing entity tags can use the updated terminology and role guidance. No required action or deadline is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Defender for Identity entity tags in Microsoft Defender XDR
This article describes how to apply entity tags in Microsoft Defender for Identity entity tags, forIdentity. You can tag accounts as sensitive, as Exchange server,servers, or honeytoken accounts.as honeytokens.
You must tagTag sensitive accountsforso that detections work correctly. Some detections, like sensitive group changes, rely on this tag.Defender for Identity
detections that rely on an entity's sensitivity status, for example, sensitive group modification detections.While Defender for Identity automaticallytags Exchange servers ashigh-value,sensitiveassets, youby default. You can alsomanuallytag devices as Exchangeservers.servers manually.Tag honeytoken accounts to set traps for malicious actors.
Since honeytokenThese accounts are usuallydormant, any authentication associated withdormant. Any sign-in from a honeytoken account triggers an alert.
Prerequisites
To set Defender for Identity entity tags in Microsoft Defender XDR,Defender, you'll need Defender for Identity deployed in your environment, and administrator or user access to Microsoft Defender XDR.Defender.
For more information, see Microsoft Defender for Identity role groups.
SailPoint Identity Security Cloud sensitive roles
The following Entra ID and SailPoint Identity Security Cloud roles are used for sensitive entity tagging in Defender for Identity.
Entra ID roles used for tagging
Related content
For more information, see Investigate Defender for Identity security alerts in Microsoft Defender.
@@ -1,27 +1,27 @@ --- title: Entity tags in Microsoft Defender for Identity description: Learn about when to use entity tags with Microsoft Defender for Identity and how to apply them in Microsoft Defender XDR.-ms.date: 06/15/2026+ms.date: 07/02/2026 ms.topic: how-to #CustomerIntent: As a Defender for Identity customer, I want to learn how to apply entity tags so that I can identify sensitive accounts in Microsoft Defender XDR. ms.reviewer: LiorShapiraa ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- -# Defender for Identity entity tags in Microsoft Defender XDR+# Defender for Identity entity tags in Microsoft Defender -This article describes how to apply Microsoft Defender for Identity entity tags, for sensitive, Exchange server, or honeytoken accounts.+This article describes how to apply entity tags in Microsoft Defender for Identity. You can tag accounts as sensitive, as Exchange servers, or as honeytokens. -- You must tag sensitive accounts for Defender for Identity detections that rely on an entity's sensitivity status, for example, sensitive group modification detections.+- Tag sensitive accounts so that detections work correctly. Some detections, like sensitive group changes, rely on this tag. - While Defender for Identity automatically tags Exchange servers as high-value, sensitive assets, you can also manually tag devices as Exchange servers.+ Defender for Identity tags Exchange servers as sensitive by default. You can also tag devices as Exchange servers manually. -- Tag honeytoken accounts to set traps for malicious actors. Since honeytoken accounts are usually dormant, any authentication associated with a honeytoken account triggers an alert.+- Tag honeytoken accounts to set traps for malicious actors. These accounts are usually dormant. Any sign-in from a honeytoken account triggers an alert. ## Prerequisites -To set Defender for Identity entity tags in Microsoft Defender XDR, you'll need Defender for Identity [deployed in your environment, as described in the Defender for Identity deployment guide](deploy-defender-identity.md), and administrator or user access to Microsoft Defender XDR.+To set Defender for Identity entity tags in Microsoft Defender, you'll need Defender for Identity [deployed in your environment](deploy-defender-identity.md), and administrator or user access to Microsoft Defender. For more information, see [Microsoft Defender for Identity role groups](role-groups.md). @@ -123,6 +123,8 @@ The following CyberArk Identity roles are designated as Sensitive by Defender fo <a name="sailpoint-identity-security-cloud"></a> ### SailPoint Identity Security Cloud sensitive roles +The following Entra ID and SailPoint Identity Security Cloud roles are used for sensitive entity tagging in Defender for Identity.+ <a name="entra-id-roles"></a> #### Entra ID roles used for tagging @@ -152,4 +154,4 @@ The following SailPoint Identity Security Cloud role is designated as Sensitive ## Related content -For more information, see [Investigate Defender for Identity security alerts in Microsoft Defender XDR](manage-security-alerts.md).+For more information, see [Investigate Defender for Identity security alerts in Microsoft Defender](manage-security-alerts.md).