Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Architecture and deployment

Pilot and deploy Microsoft Defender for Identity

4 September 2026Doc update+10 / −10 lines

In brief

The article replaces references to Microsoft Defender XDR with Microsoft Defender across headings, descriptions, integration guidance, and the Defender portal link.

What Defender admins need to know

Administrators following the pilot and deployment workflow will see the updated Microsoft Defender terminology and link. No action is stated as required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Pilot and deploy Microsoft Defender for Identity

This article provides a workflow for piloting and deploying Microsoft Defender for Identity in your organization. Use these recommendations to onboard Microsoft Defender for Identity as part of an end-to-end solution with Microsoft Defender XDR.Defender.

This article assumes you have a production Microsoft 365 tenant and are piloting and deploying Microsoft Defender for Identity in this environment. This practice will maintain any settings and customizations you configure during your pilot for your full deployment.

Defender for Identity contributes to a Zero Trust architecture by helping to prevent or reduce business damage from a breach. For more information, see the Prevent or reduce business damage from a breach business scenario in the Microsoft Zero Trust adoption framework.

End-to-end deployment for Microsoft Defender XDR

This is article 2 of 6 in a series to help you deploy the components of Microsoft Defender XDR, including investigating and responding to incidents.

Phase Link
A. Start the pilot Start the pilot
B. Pilot and deploy Microsoft Defender XDR components - Pilot and deploy Defender for Identity (this article)

- Pilot and deploy Defender for Office 365

- Pilot and deploy Defender for Endpoint

- Pilot and deploy Microsoft Defender for Cloud Apps
C. Investigate and respond to threats Practice incident investigation and response

Pilot and deploy workflow for Defender for Identity

Protecting your organization from hackers

Defender for Identity provides powerful protection on its own. However, when combined with the other capabilities of Microsoft Defender XDR,Defender, Defender for Identity provides data into the shared signals which together help stop attacks.

Here's an example of a cyber-attack and how the components of Microsoft Defender XDR help detect and mitigate it.

Defender for Identity gathers signals from Active Directory Domain Services (AD DS) domain controllers and servers running Active Directory Federation Services (AD FS) and Active Directory Certificate Services (AD CS). It uses these signals to protect your hybrid identity environment, including protecting against hackers that use compromised accounts to move laterally across workstations in the on-premises environment.

Microsoft Defender XDR correlates the signals from all the Microsoft Defender components to provide the full attack story.

Defender for Identity architecture

Microsoft Defender for Identity is fully integrated with Microsoft Defender XDR and leverages signals from on-premises Active Directory identities to help you better identify, detect, and investigate advanced threats directed at your organization.

Deploy Microsoft Defender for Identity to help your Security Operations (SecOps) teams deliver a modern identity threat detection and response (ITDR) solution across hybrid environments, including:

  • Sensors installed on AD DS domain controllers and AD CS servers parse logs and network traffic and send them to Microsoft Defender for Identity for analysis and reporting.
  • Sensors can also parse AD FS authentications for third-party identity providers and when Microsoft Entra ID is configured to use federated authentication (the dotted lines in the illustration).
  • Microsoft Defender for Identity shares signals to Microsoft Defender XDR.Defender.

Defender for Identity sensors can be directly installed on the following servers:

Step 1: Set up the Defender for Identity instance

Sign in to the Defender portal to start deploying supported services, including Microsoft Defender for Identity. For more information, see Start using Microsoft Defender.

You can integrate Defender for Identity with Microsoft Sentinel for unified security operations in the Defender portal, or with a generic security information and event management (SIEM) service to enable centralized monitoring of alerts and activities from connected apps. With Microsoft Sentinel, you can more comprehensively analyze security events across your organization and build playbooks for effective and immediate response.

The Defender portal supports unified security operations with Microsoft Sentinel, bringing signals from Defender XDR,Defender, including Defender for Identity, to Microsoft Sentinel.

For more information, see:

Next step for the end-to-end deployment of Microsoft Defender XDR

Continue your end-to-end deployment of Microsoft Defender XDR with Pilot and deploy Defender for Office 365.