Manage related identities and accounts in Microsoft Defender for Identity

In enterprise environments, identities are often fragmented. A single user might have multiple accounts across systems, including personal, privileged, legacy, cloud-based, or orphaned accounts. These accounts can cover on-premises Active Directory, Microsoft Entra ID, or non-Microsoft identity providers such as Okta and Ping.

• Improve protection by creating a complete identity context.
• Support investigations and response actions with unified identity views.

You can correlate accounts in either of the following ways:

• Manual correlation: Link individual accounts to an identity by using the procedures in this article.
• Rule-based correlation: Use account correlation rules to automatically correlate accounts. In the Microsoft Defender portal, go to Settings > Identities > Account Correlation Rules. For details, see Manage account correlation rules.

For example:

• Personal and privileged accounts: A user might have two accounts, one for everyday work and another with elevated permissions for administrative tasks. For example:
  • [email protected]
• Accounts in multiple services: A user might have a Microsoft Entra ID account, an Okta account, and a Ping account. Manually linking these accounts to the user's identity creates a consolidated view that supports identity-centric protection and investigation.

Use the procedures in this article to manually link accounts to identities,identities and to manually unlink unused, legacy, or orphaned accounts from identities in Defender for Identity.

Prerequisites