Protecting Your Hybrid Identity Environment with Microsoft Defender for Identity

Microsoft Defender for Identity (MDI) is a powerful tool that plays a critical role in safeguarding your hybrid identity environment. As a component of the Microsoft 365 Defender suite, MDI gathers signals from on-premises Active Directory servers and uses these signals to protect your organization against hackers who attempt to leverage compromised accounts to move laterally across your on-premises workstations.

How MDI Works

MDI achieves this through the use of a sensor agent that you install on each domain controller. Over time, the sensor learns about your network and end-user behavioral patterns, allowing it to detect anomalies and alert you to any suspicious activity that requires investigation.

Setting Up MDI

To get started with MDI, you’ll need to follow a few key steps:

  1. Set up the Defender for Identity Instance: Begin by connecting to your Azure Domain Controller VM and signing in to the Microsoft 365 Defender portal. From there, navigate to the Settings > Identities section to initiate the creation of your Defender for Identity instance.

  2. Create the Directory Service Account: Defender for Identity requires a dedicated Directory Service account that the sensor can use to query the domain controller and track data for analysis. This account should be a regular user account without domain administrator privileges.

  3. Configure the Directory Service Account: Once you’ve created the account, return to the Microsoft 365 Defender portal and go to Settings > Identities > Directory Service Accounts. Add the credentials for the account you just created.

  4. Install the Sensor: In the Defender for Identity portal, go to the Sensors section and click the Add sensor button. This will provide you with an installer and an access key that you’ll need to complete the sensor installation on your domain controller.

  5. Disable the Learning Period: By default, Defender for Identity requires a learning period of up to 30 days per domain controller to build a baseline of your network and end-user behavior. To speed up this process, you can disable the learning period in the Advanced settings section of the Defender for Identity portal.

Generating and Viewing Alerts

To test the capabilities of Defender for Identity, you can perform some simple attack simulations, such as using nslookup to attempt a DNS zone transfer. This will trigger an alert in the Defender for Identity portal, which you can then investigate further.

By navigating to the Device summary page and then the Timeline, you’ll be able to see the event logged for the suspicious nslookup command, providing you with valuable insights into the activity that triggered the alert.

Overall, Microsoft Defender for Identity is a crucial tool for protecting your hybrid identity environment, helping you detect and respond to threats that target your on-premises infrastructure. By following the steps outlined in this guide, you can quickly get up and running with MDI and start leveraging its powerful capabilities to keep your organization secure.

For more information, be sure to check out the Microsoft Defender for Identity documentation.