Microsoft Defender for Identity Platform Support

• Microsoft Defender for Identity is a hosted service that discovers authentication risks within on-premises Active Directory.
• Benefits for non-Windows devices and non-AD joined devices are limited.
• Customers who have integrated on-premises AD and hosted Entra ID may still find some benefit.

Microsoft Defender for Identity is a subscription-based Microsoft-hosted service that uses data gathered from on-premises Windows Server Active Directory (AD) domain controllers to help organizations discover malicious use of user accounts within AD on-premises. Because the service only analyzes traditional on-premises AD authentication, the applicability for non-Windows devices and any device used outside of the Windows network is quite limited. Organizations with integrated AD and Entra ID may still find some benefit in analyzing Entra ID authentication operations that occur against on-premises infrastructure. 

Microsoft Defender for Identity Security Basics

Microsoft Defender for Identity is based on Microsoft’s Advanced Threat Analytics (ATA) on-premises software, itself acquired from Aorato.