Microsoft Defender for Identity

E325215

Microsoft security product cloud-based security solution identity threat protection product

Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.

Try in SPARQL Jump to: Surface forms Disambiguation Statements Elicitation Referenced by

All labels observed (2)

Label	Occurrences
Microsoft Defender for Identity canonical	3
Azure Advanced Threat Protection	1

How this entity was disambiguated

This entity first appeared as the object of triple T3058533 — resolving that mention is where its identity was fixed. The disambiguator weighed these candidate entities and picked the highlighted one (or “None”, minting a new entity). This is how homonymy is resolved: the same surface form can point to different entities.

NED1 Entity disambiguation (via context triple) gpt-5-mini-2025-08-07

Target entity: Microsoft Defender for Identity
Context triple: [Microsoft 365 E5, includes, Microsoft Defender for Identity]

A. Microsoft 365 Defender
Microsoft 365 Defender is Microsoft’s unified, cloud-based security suite that coordinates protection, detection, and response across endpoints, email, identities, and applications in the Microsoft 365 ecosystem.
B. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is an enterprise-grade endpoint security platform from Microsoft that provides advanced threat protection, detection, and response capabilities across organizational devices and networks.
C. Microsoft Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email and collaboration security solution that protects Microsoft 365 users from phishing, malware, and other advanced threats.
D. Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
E. Microsoft Entra
Microsoft Entra is Microsoft’s unified identity and access management product family that secures access to applications, resources, and digital identities across cloud and hybrid environments.
F. None of above. chosen
G. Unsure - the case is ambiguous/there is not enough information to decide.

NED2 Entity disambiguation (via description) gpt-5-mini-2025-08-07

Target entity: Microsoft Defender for Identity
Target entity description: Microsoft Defender for Identity is a cloud-based security solution that uses on-premises Active Directory signals to detect, investigate, and respond to advanced identity-based threats in enterprise environments.

A. Microsoft 365 Defender
Microsoft 365 Defender is Microsoft’s unified, cloud-based security suite that coordinates protection, detection, and response across endpoints, email, identities, and applications in the Microsoft 365 ecosystem.
B. Microsoft Defender for Endpoint
Microsoft Defender for Endpoint is an enterprise-grade endpoint security platform from Microsoft that provides advanced threat protection, detection, and response capabilities across organizational devices and networks.
C. Microsoft Defender for Office 365
Microsoft Defender for Office 365 is a cloud-based email and collaboration security solution that protects Microsoft 365 users from phishing, malware, and other advanced threats.
D. Privileged Identity Management
Privileged Identity Management is a Microsoft security service that provides just-in-time, approval-based, and time-limited access to sensitive roles and resources to reduce the risks associated with standing administrative privileges.
E. Microsoft Entra
Microsoft Entra is Microsoft’s unified identity and access management product family that secures access to applications, resources, and digital identities across cloud and hybrid environments.
F. None of above. chosen

Statements (53)

Predicate	Object
instanceOf	Microsoft security product ⓘ cloud-based security solution ⓘ identity threat protection product ⓘ
deploymentModel	hybrid ⓘ
detects	advanced identity-based threats ⓘ brute-force attacks ⓘ compromised credentials ⓘ domain dominance activities ⓘ kerberoasting attacks ⓘ lateral movement ⓘ malicious insider activities ⓘ pass-the-hash attacks ⓘ pass-the-ticket attacks ⓘ privilege escalation attempts ⓘ reconnaissance activities ⓘ suspicious user activities ⓘ
developer	Microsoft ⓘ
formerlyKnownAs	Microsoft Defender for Identity self-linksurface differs ⓘ surface form: Azure Advanced Threat Protection
integratesWith	Azure Active Directory ⓘ surface form: Azure AD Identity Protection Microsoft 365 Defender ⓘ surface form: Microsoft 365 Defender portal Microsoft Defender for Cloud Apps ⓘ Microsoft Defender for Endpoint ⓘ Microsoft Sentinel ⓘ
monitors	authentication patterns ⓘ entity behavior ⓘ lateral movement paths ⓘ on-premises Active Directory environments ⓘ user activities ⓘ
partOf	Microsoft 365 Defender ⓘ Microsoft Defender ⓘ
provides	attack timeline views ⓘ entity profiles ⓘ lateral movement path analysis ⓘ security alerts ⓘ security recommendations ⓘ
requires	Active Directory domain controller access ⓘ sensors on domain controllers ⓘ
runsOn	cloud ⓘ
securityDomain	identity security ⓘ incident response ⓘ threat detection ⓘ threat investigation ⓘ
supports	automated response ⓘ incident investigation ⓘ threat hunting ⓘ
targetUser	enterprise organizations ⓘ security operations teams ⓘ
uses	Windows event logs ⓘ behavioral analytics ⓘ machine learning ⓘ network traffic data ⓘ on-premises Active Directory signals ⓘ security alerts ⓘ

How these facts were elicited

Referenced by (4)

Full triples — surface form annotated when it differs from this entity's canonical label.

Microsoft 365 E5 → includes → Microsoft Defender for Identity ⓘ

Microsoft 365 Defender → integratesWith → Microsoft Defender for Identity ⓘ

Microsoft Defender for Endpoint → integratesWith → Microsoft Defender for Identity ⓘ

Microsoft Defender for Identity → formerlyKnownAs → Microsoft Defender for Identity self-linksurface differs ⓘ

this entity surface form: Azure Advanced Threat Protection

All labels observed (2)

How this entity was disambiguated Show

Statements (53)

How these facts were elicited Show

Referenced by (4)

How this entity was disambiguated

How these facts were elicited