Why is MDI important?
As stated at the beginning of this chapter, MDI is a cloud-based security feature that leverages signals (such as event IDs, traffic, and event trace logs (ETLs) from your on-premises Active Directory (AD) to identify, detect, and investigate threats within your environment.
Internet connectivity
MDI sensors must be able to connect to the internet, and we highlight this right at the start as, historically, and quite rightly, many domain controllers are completely restricted from the internet. Web proxy connections are supported, but Secure Sockets Layer (SSL) inspection is not. Make sure your network appliances and firewalls strictly limit and control any traffic you need to open to only the official requirements, found here: learn.microsoft.com/en-us/defender-for-identity/prerequisites#defender-for-identity-firewall-requirements.
This feature allows us to add another log source into Microsoft 365 Defender that greatly increases our capability for correlation...
