Chapter 4: Implementing Microsoft Defender for Identity

Now that we've covered the deployment process of Microsoft Defender for Endpoint (MDE), it's time to move on to Microsoft Defender for Identity (MDI). This tool, in my opinion, is perhaps one of the best, if not the best, tools in the Microsoft 365 security stack. We can talk all day long about how the cloud is everything right now, but the reality is that most businesses have an on-premises presence, and that almost always means Active Directory. With Active Directory being at the core of operations as the hierarchal structure of your computer and user accounts within an environment, it's critical we keep it protected by monitoring its signals.

Firstly, its previous name is Azure Advanced Threat Protection (AATP), and no – it's not the same as Advanced Threat Analytics (ATA). I'll explain why. I always hear confusion about ATA, AATP, and MDI, with people asking whether MDI is an improvement...