Microsoft Defender for Identity Features

Analysis (4)

Continuous Analysis: Constantly monitors traffic and activity. Detects anomalies in functionality, user accessibility, traffic flows, and tampering.
Behavioral Analysis: Constantly monitors acivity related to user behavior and compares activity to benchmarked patterns and fraud indicators.
Data Context: Provide insights into why trends are occurring and what issues could be related.
Activity Logging: Monitors, records, and logs both real-time and post-event activity.

Detection (3)

Anomaly Detection: Constantly monitors activity related to user behavior and compares activity to benchmarked patterns.
Incident Alerts: Gives alerts when incidents arise. Some responses may be automated, but users will still be informed.
Activity Monitoring: Monitors the actions from endpoints within a network. Alerts users of incidents and abnormal activities and documents the access point.

Monitoring (6)

Investigate: Investigate identity threats with contextual user information.
Monitoring: Monitor & detect malicous identity and privileges activity
Misconfigurations: Identify identity-related misconfigurations.
Integrate: Offers integrations to identity store providers.
Visability: Provide full coverage of identity estate with granular detail.
Continuous Monitoring: Conduct tracking and assessment of application and device behavior without breaks or interruptions

Remediation (2)

Agentic AI - User and Entity Behavior Analytics (UEBA) (4)

Additional Functionality (25)

Role-Based Permissions: Set & manage permission levels based on user roles and restrict access to only authorized individuals
Data Analysis Tools: Analyze survey results via statistical testing or crosstabs directly within the software
Anomaly/Malware Detection: Automatically identify and flag unusual behaviors and malicious software
Risk Alerts: Notifying as a warning or reminder of a potential or imminent hazard
Password Management: Generate and store passwords in an encrypted database and assist in retrieving lost or forgotten passwords
Access Management: Control and manage access to company resources
Data Classification: Grouping log entries based on similar attributes.
Access Control: Regulate who can view information within the system
Incident Response Checklists: Checklist to confirm the incident and response.
Active Directory Integration: Integrates with Active Directory
Multi-Factor Authentication: Request two or more credentials to prove user's identity before granting access to systems
Search/Filter: Search and filter data across systems to locate required information by entering keywords or certain criteria
Real-time Alerts: Receive notification of issues as soon as they occur
Remediation Management: Identify and orchestrate execution of actions needed to restore systems to optimal conditions
Risk-Based Authentication: Determine the risk profile of a user requesting access before granting access
Configuration Management: Identify component attributes like servers, hardware, software, and manage relationships across all services
Generative AI: Use AI to generate content in the form of text, images, videos, etc.
Activity Dashboard: Dashboard to view the status of ongoing processes, identify current incidents and track past activities
AI Copilot: A virtual assistant that uses AI to pursue goals and complete tasks on behalf of users
Prioritization: Arrange tasks based on the level of priority or urgency
Deception Management: Deploy realistic decoys that lure away from real assets within a given network
Root Cause Analysis: Identify and analyse the reasons behind accidents
Identity Verification: Validating the identity of an individual or entity through verification of personal information or credentials
Access Certification: Verify user access rights within systems to confirm each user has appropriate and authorized access to resources
Behavioral Analytics: Track and analyse user behavior within a system or network