Microsoft Defender for Identity Enterprise Implementation Guide

Overview

Microsoft Defender for Identity (MDI), formerly Azure Advanced Threat Protection, is a cloud-based security service that monitors on-premises Active Directory signals to detect identity compromise, lateral movement, reconnaissance, and privilege escalation. Enterprises use it to strengthen hybrid identity security, enrich investigations in Microsoft 365 Defender, and reduce time to detect attacks that target domain controllers, privileged accounts, and trust relationships.

MDI is especially valuable in environments where Active Directory remains the control plane for authentication and authorization. By analyzing directory traffic, Windows events, and entity behavior, it helps defenders identify techniques such as Pass-the-Hash, DCSync, Kerberos abuse, and suspicious account enumeration.

Architecture

MDI consists of several core components:

• Defender for Identity cloud service for analytics, alerting, and investigation.
• Defender for Identity sensor installed directly on domain controllers.
• Defender for Identity standalone sensor for environments using port mirroring, though direct sensor deployment is the standard model.
• Microsoft 365 Defender portal for incident correlation across identity, endpoint, email, and cloud apps.

Deployment model

The preferred enterprise model is direct installation of the sensor on every writable domain controller and AD FS server where relevant. Sensors collect:

• Directory Services network traffic
• Windows Event Logs
• ETW-based signals
• Security-relevant metadata from domain controllers

Data flow

1. Sensor is installed on the domain controller.
2. Sensor reads local events and network activity.
3. Telemetry is encrypted and sent outbound over HTTPS to the Defender for Identity cloud service.
4. Alerts and entity profiles are surfaced in Microsoft 365 Defender.
5. Incidents can be correlated with Microsoft Defender for Endpoint and Microsoft Sentinel.

Implementation Guide

1. Validate prerequisites

• Microsoft 365 E5, E5 Security, or Defender for Identity licensing
• Global Administrator or Security Administrator for onboarding
• Domain controllers running supported Windows Server versions
• Outbound HTTPS access to Microsoft Defender endpoints
• .NET Framework and auditing configured per Microsoft guidance

2. Enable the service

In the Microsoft 365 Defender portal, go to Settings > Identities and enable Defender for Identity. Download the sensor setup package and access key.

3. Install the sensor silently

Run on each domain controller from an elevated PowerShell session:

MicrosoftDefenderForIdentitySensorSetup.exe /quiet /norestart AccessKey="<access-key>"

For mass deployment with software distribution:

msiexec /i Azure ATP Sensor Setup.msi /qn ACCESSKEY="<access-key>"

4. Verify service health

Get-Service AATPSensor
Get-WinEvent -LogName "Microsoft-Azure ATP/Operational" -MaxEvents 20
Test-NetConnection portal.atp.azure.com -Port 443

5. Configure event collection and auditing

Enable advanced audit policy on domain controllers:

auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable

6. Configure exclusions and tagging

Use the portal to mark sensitive accounts, honeytoken accounts, and entity tags for privileged users, service accounts, and domain admins.

Code Examples

Example 1: PowerShell deployment script

$servers = @("dc01.corp.contoso.com","dc02.corp.contoso.com")
$installer = "\\fileserver\software\MicrosoftDefenderForIdentitySensorSetup.exe"
$key = "REDACTED-ACCESS-KEY"
foreach ($server in $servers) {
  Copy-Item $installer "\\$server\c$\Temp\mdi-setup.exe"
  Invoke-Command -ComputerName $server -ScriptBlock {
    Start-Process "C:\Temp\mdi-setup.exe" -ArgumentList '/quiet /norestart AccessKey="REDACTED-ACCESS-KEY"' -Wait
    Get-Service AATPSensor
  }
}

Example 2: GPO audit baseline

audit_policy:
  Directory Service Access:
    success: true
    failure: true
  Logon:
    success: true
    failure: true
  Kerberos Authentication Service:
    success: true
    failure: true
  Kerberos Service Ticket Operations:
    success: true
    failure: true

Example 3: Microsoft Graph security incidents query

import requests
token = "eyJ..."
url = "https://graph.microsoft.com/v1.0/security/incidents?$filter=contains(displayName,'Identity')"
headers = {"Authorization": f"Bearer {token}"}
r = requests.get(url, headers=headers, timeout=30)
print(r.status_code)
print(r.json())

Security Hardening

• Install sensors on all writable domain controllers to avoid blind spots.
• Restrict local administrator access on domain controllers using tiered administration.
• Ensure outbound TLS inspection devices do not break certificate validation for Defender endpoints.
• Protect the sensor installation package and access key as secrets.
• Use RBAC in Microsoft 365 Defender; grant Security Reader for monitoring and Security Operator or Administrator only where needed.
• Enable LAPS, Credential Guard, and Defender for Endpoint on domain-adjacent systems to improve cross-signal detection.
• Monitor for unsigned LDAP, NTLM usage, and legacy protocols that increase identity attack surface.

Comparison

Troubleshooting

Error 1: Sensor service fails to start

Log sample:

{"TimeCreated":"2026-02-11T08:14:22Z","ProviderName":"Microsoft-Azure ATP Sensor","Id":23,"LevelDisplayName":"Error","Message":"Sensor service failed to start. Configuration validation failed due to invalid access key."}

Fix: Reinstall the sensor with the correct access key and verify system time synchronization.

Error 2: Connectivity failure to cloud service

Log sample:

{"TimeCreated":"2026-02-11T09:02:41Z","ProviderName":"Microsoft-Azure ATP Sensor","Id":35,"LevelDisplayName":"Warning","Message":"Failed to upload telemetry to service endpoint. System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel."}

Fix: Check outbound proxy, TLS inspection, root CA trust, and firewall rules for Defender for Identity endpoints.

Error 3: Missing event data

Log sample:

{"TimeCreated":"2026-02-11T09:17:03Z","ProviderName":"Microsoft-Azure ATP Sensor","Id":28,"LevelDisplayName":"Warning","Message":"Required Windows event auditing is not configured. Detection coverage may be reduced for domain controller DC01."}

Fix: Apply the required advanced audit policy via GPO and force policy refresh with gpupdate /force.

Best Practices

Do

• Deploy to every domain controller in every domain and site.
• Integrate with Microsoft Sentinel for long-term retention and SOC workflows.
• Tag sensitive accounts such as Domain Admins, KRBTGT-related monitoring, and service accounts.
• Use honeytoken accounts with no operational use to detect reconnaissance.

Don’t

• Do not install on only a subset of domain controllers; this creates detection gaps.
• Do not ignore health alerts for event collection or connectivity issues.
• Do not overprivilege portal access; use least privilege and separate administration roles.
• Do not rely on identity telemetry alone; combine MDI with endpoint, email, and cloud signals for full incident context.