Microsoft Defender for Identity vs. Entra ID Protection differences?

Question

Microsoft Defender for Identity vs. Entra ID Protection differences?

EnterpriseArchitect 6,041

Hi Folks, What are the differences between Microsoft Defender for Identity vs. Entra ID Protection? My Environment is already on Entra ID Premium P2, and some of my users already have M365 E5 license According to this article: https://learn.microsoft.com/en-us/defender-for-identity/deploy/quick-installation-guide#licensing-requirements only one of the licenses is required, not all. Does it mean the users with m365 E5 licenses are automatically protected, while the rest are not protected? Any help would be greatly appreciated.

Accepted answer

0 additional answers

Your answer

Answer 1

Hello @EnterpriseArchitect

Microsoft Defender for Identity and Entra ID Protection are both identity protection solutions offered by Microsoft, but they have different focuses and features.

Microsoft Defender for Identity

Entra ID Protection (Premium P2)

It is designed to detect and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. It provides real-time monitoring and profiling of user behavior, activities, and generates alerts for suspicious activities. It requires one of the following Microsoft 365 licenses: Enterprise Mobility + Security E5 (EMS E5/A5), Microsoft 365 E5 (Microsoft E5/A5/G5), Microsoft 365 E5/A5/G5 Security, or a standalone Defender for Identity license.

It provides a more comprehensive set of identity protection and management capabilities. It includes features like risk-based conditional access, identity protection, privileged identity management, and more. It is included in the Microsoft 365 E5 license.

In terms of licensing, if a user has a Microsoft 365 E5 license, they should be able to leverage benefits for both Microsoft Defender for Identity and Entra ID Protection. However, both require additional configurations and settings to make sure user is protected with specific service features.

For Microsoft Defender for Identity

It requires installing Microsoft Defender for Identity sensors on Active Directory, Active Directory Federation Services (AD FS), or Active Directory Certification Services (AD CS) servers.
Documentation Link: https://learn.microsoft.com/en-us/defender-for-identity/deploy/quick-installation-guide

For Microsoft Identity Protection:

It requires users to be targeted in Risk Policies or Conditional Access Risk Policy.
Documentation Link: https://learn.microsoft.com/en-us/entra/id-protection/how-to-deploy-identity-protection

I hope this answer helps to resolve your issue. Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

EnterpriseArchitect 6,041 Reputation points

2024-02-14T10:14:19.0133333+00:00

@Harpreet Singh Matharoo ,
Thank you for clarifying; I am using Hybrid Azure AD/Entra ID with 100+ OnPremise AD DS synced using Password Hash Sync. Do I have to install all Defender Sensors in AD DS Domain Controllers? Regarding protection and licensing, does the Entra ID Protection only work for my M365 E5 assigned users or everyone in my Entra ID?
Harpreet Singh Matharoo 8,396 Reputation points Microsoft Employee Moderator

2024-02-16T04:10:25.5866667+00:00

For your first question:

Microsoft Defender for Identity sensors are typically installed directly on your domain controllers, Active Directory Federation Services (AD FS), or Active Directory Certificate Services (AD CS) servers.

The sensors access the event logs they require directly from the servers.

However, the exact number of sensors you need to install would depend on your specific network architecture and security requirements.

For more detailed instructions, you can refer to the Microsoft Defender for Identity Sensor Installation Guide and Quick Installation Guide.

For your second question:

Microsoft Entra ID Protection helps organizations detect, investigate, and remediate identity-based risks.

You can configure risk-based Microsoft Entra Conditional Access policies that automatically respond to risky behaviors.

These policies can automatically block a sign-in attempt or require extra action, such as requiring a secure password change or prompting for Microsoft Entra multifactor authentication.

You can include all users or specific groups of users in these policies.

Therefore, while Azure AD/Entra ID Premium P2 is a per user license you should apply license to users assigned in the policy. However, you also have the flexibility to extend these protections to other users in your Entra ID as per your organization’s needs.

For more information, please review following documentation: https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection#license-requirements
EnterpriseArchitect 6,041 Reputation points

2024-02-16T04:50:45.02+00:00

Thank you @Harpreet Singh Matharoo .

Share via

Microsoft Defender for Identity vs. Entra ID Protection differences?

0 additional answers

Your answer