Microsoft Defender for Identity Features

Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.

Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns and fraud indicators.

Provide insights into why trends are occurring and what issues could be related.

Monitors, records, and logs both real-time and post-event activity.

Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.

Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.

Monitors the actions from endpoints within a network. Alerts users of incidents and abnormal activities and documents the access point.

Investigate identity threats with contextual user information.

Monitor & detect malicous identity and privileges activity

Identify identity-related misconfigurations.

Offers integrations to identity store providers.

Provide full coverage of identity estate with granular detail.

Remove unauthorized accounts and excessive privileges

Provides full audit trail with notifications, ticketing, and compliance information.

Capability to perform complex tasks without constant human input

Ability to break down and plan multi-step processes

Anticipates needs and offers suggestions without prompting

Makes informed choices based on available data and objectives