Configuring a Microsoft Defender for Identity Solution

As you learned in Chapter 1, Planning for Hybrid Identity, the default identity method in Microsoft 365 is cloud-only. However, very few organizations are in the fortunate position to leverage cloud-only identities. Start-up businesses and organizations with minimal infrastructure find adopting this method easier than those with more complex infrastructure and a long-term reliance on on-premises Active Directory and legacy applications. The latter will likely leverage some form of hybrid identity strategy.

Organizations with this challenge need to consider how to extend the cloud-based protection features included in Microsoft 365 to their on-premises Active Directory domain controllers. This is possible with Microsoft Defender for Identity (MDI), which was formerly known as Azure Advanced Threat Protection or Azure ATP. MDI is a Microsoft 365 cloud-based solution that leverages signals from your on-premises Active Directory...

Identifying the organizational need for MDI

To identify your organization’s needs in relation to MDI, you first need to examine, in great detail, exactly what MDI is and what it can do. Essentially, MDI is a security solution designed for use in hybrid cloud environments that have a mixture of on-premises and cloud users, data, and resources.

MDI can monitor your on-premises domain controllers to identify and investigate advanced threats and compromised identities by using machine learning and behavioral algorithms to do the following:

• Identify suspicious activity
• Detect and identify advanced attacks and malicious activities
• Protect Azure Active Directory (AD) identities and credentials
• Provide incident reports

MDI can create behavioral profiles for your users and diligently analyze user activities and events to detect any advanced threats, compromised users, and malicious insiders that could threaten your organization. The information gathered...

Understanding the MDI architecture

MDI is a combination of services and components that work together to provide your Microsoft 365 hybrid deployment with comprehensive protection from modern threats and attacks. You can view the MDI architecture at https://learn.microsoft.com/en-us/defender-for-identity/architecture. Here, sensors are installed on AD FS servers and domain controllers. These sensors send signals to Microsoft 365 Defender about Active Directory entities, parsed traffic, and Windows events and traces.

MDI can function to protect your hybrid identity by leveraging the following three key components:

• The Microsoft 365 Defender portal, in which you create your MDI instance, as well as monitor and address any threats that have been reported.
• The MDI sensor, which is installed on your on-premises domain controllers and is used to monitor domain controller traffic. It can also be installed on your AD FS servers to directly monitor network traffic and authentication...

Setting up MDI

Before setting up MDI, you need to be familiar with the prerequisites for using MDI in your organization. Let’s take a look at these in the next section.

Prerequisites for MDI

The following prerequisites should be considered and understood prior to deploying MDI in your organization:

• Supported Licensing:
  • Enterprise Mobility + Security E5 (EMS E5/A5)
  • Microsoft 365 E5 (M365 E5/A5/G5) or Microsoft 365 E5/A5/G5 Security
  • Standalone Defender for Identity licenses
• Accounts:
  • A minimum of one Directory Service account with read access for all objects in the monitored domains
• Permissions:
  • Access to your Azure AD tenant with at least Global Administrator or Security Administrator access
  • Active Directory Forest Functional Level (FFL) of Windows 2003 and above

Note

Further prerequisites such as firewall and port requirements can be found in the Further reading section at the end of this chapter.

Once you understand the prerequisites, you can set...

Managing and monitoring MDI

You can now start managing and monitoring the MDI service. From a management perspective, this means configuring settings and features such as Entity tags and Excluded entities. From a monitoring perspective, it is important to review MDI regularly by looking at Health Issues from the General section of the MDI settings page.

Some of these capabilities are presented in greater detail next

Entity tags

MDI allows you to apply Entity tags to sensitive accounts. The status of the tags that you define enables MDI to detect things such as sensitive group modification and lateral movement. Additionally, honeytoken accounts may be configured to trap malicious actors and trigger an alert.

You can configure the three following types of entity tags in MDI:

• Sensitive tags
• Honeytoken tags
• Exchange server tags

The following sections explain these tags in detail.

Sensitive tags

You can use the Sensitive tag to identify assets of...

Summary

In this chapter, we examined Microsoft Defender for Identity (MDI), which is a feature that's included with Enterprise Mobility + Security E5 and Microsoft 365 E5. It enables you to protect your Microsoft 365 hybrid cloud environment against malicious actors attempting to access vulnerable user accounts and devices and conduct reconnaissance activities to gain elevation of privilege and achieve domain dominance.

We also learned how to configure MDI in the Microsoft 365 Defender portal and install sensors on domain controllers. We looked at how entity tags can be configured to establish sensitive accounts, honeytoken accounts, and exchange servers and set to trigger alerts when matched to suspicious activity. We then considered how MDI establishes a timeline of suspicious and malicious activities, the steps that can be taken to review and resolve these within the MDI health center, and how to use notifications and alerts.

In the next chapter, we will examine the principles...

Questions

1. Which of the following is not a type of MDI sensor deployment type?
   1. Sensor
   2. Pass-through authentication
   3. AD FS
   4. Standalone
2. Where do you go to configure MDI?
   1. The Microsoft Purview compliance center
   2. The Microsoft 365 Defender portal
   3. The Microsoft 365 admin center
   4. The Endpoint Manager admin center
3. True or false? You can migrate an instance of Advanced Threat Analytics (ATA) to Microsoft Defender for Identity.
   1. True
   2. False
4. Which of the following are types of entity tags (choose three)?
   1. DNS server
   2. Exchange server
   3. Honeytoken
   4. Confidential
   5. Sensitive
5. True or false? An MDI instance is NOT automatically created in the closest geographical data center.
   1. True
   2. False
6. Which of the following are not types of alerts displayed in the MDI health center (choose two)?
   1. Open
   2. Pending
   3. Suppressed
   4. Closed
   5. Deferred
7. Which of the following are types of entity exclusion listed in the MDI portal menu (choose two)?
   1. User excluded entities
   2. Global excluded entities
   3. Device excluded entities
   4. Exceptions by detected...

Further reading

Please refer to the following links for more information:

• MDI prerequisites: https://learn.microsoft.com/en-us/defender-for-identity/prerequisites
• MDI architecture: https://learn.microsoft.com/en-us/defender-for-identity/architecture
• MDI documentation: https://learn.microsoft.com/en-us/defender-for-identity/what-is
• Deploying MDI: https://learn.microsoft.com/en-us/defender-for-identity/deploy-defender-identity
• Download the MDI sensor: https://learn.microsoft.com/en-us/defender-for-identity/download-sensor
• Configure sensor settings: https://learn.microsoft.com/en-us/defender-for-identity/configure-sensor-settings
• Installing an MDI sensor: https://learn.microsoft.com/en-us/defender-for-identity/install-sensor
• Configure endpoint proxy settings for MDI: https://learn.microsoft.com/en-us/defender-for-identity/configure-proxy
• Manage MDI action accounts: https://learn.microsoft.com/en-us/defender-for-identity/manage-action-accounts
...

The rest of the chapter is locked