Deploying Microsoft Defender for Identity

This chapter will focus on deploying Microsoft Defender for Identity (MDI) in your organization by digging into what it does, how it will help you detect and respond to identity-based threats on-premises, why it is an important security feature to have in place, and the dos and don’ts when it comes to configuring MDI.

Additionally, the chapter provides insights into best practices for optimizing MDI performance and troubleshooting common issues. By following the instructions in this chapter, organizations can deploy MDI and ensure that their identity infrastructure is effectively protected against advanced cyber threats.

In a nutshell, we will cover the following main topics in this chapter:

• Why is MDI is important?
• How to deploy MDI

Why is MDI important?

As stated at the beginning of this chapter, MDI is a cloud-based security feature that leverages signals (such as event IDs, traffic, and event trace logs (ETLs) from your on-premises Active Directory (AD) to identify, detect, and investigate threats within your environment.

Internet connectivity

MDI sensors must be able to connect to the internet, and we highlight this right at the start as, historically, and quite rightly, many domain controllers are completely restricted from the internet. Web proxy connections are supported, but Secure Sockets Layer (SSL) inspection is not. Make sure your network appliances and firewalls strictly limit and control any traffic you need to open to only the official requirements, found here: learn.microsoft.com/en-us/defender-for-identity/prerequisites#defender-for-identity-firewall-requirements.

This feature allows us to add another log source into Microsoft 365 Defender that greatly increases our capability for correlation...

Deploying MDI

Now we’ve recapped the significance of MDI for AD defense in depth, let’s discuss how it can be configured on-premises in the following section.

Getting on-premises AD ready for MDI

MDI relies on specific audit event log entries to provide detections and add additional information on who or what performed those actions on your AD Domain Services (ADDS) or AD Federation Services (ADFS) infrastructure.

The following Windows events need to be configured in the Advanced Audit Policy on each domain controller:

• 4662 – An Operation was Performed on an Object
• 4726 – User Account Deleted
• 4728 – Member Added to Global Security Group
• 4729 – Member Removed from Global Security Group
• 4730 – Global Security Group Deleted
• 4732 – Member Added to Local Security Group
• 4733 – Member Removed from Local Security Group
• 4741 – Computer Account Added
• 4743 – Computer Account...

Summary

This chapter has been all about introducing MDI and understanding what it is, how we can deploy it in different ways, and lastly, why it is a feature of utmost importance currently, with cybercrime being an industry on the rise and threat actors actively using the blind spots in our identity infrastructure to gain persistence within our environments.

Following the steps outlined in this chapter helps us to deploy MDI in our environment. MDI, when correctly deployed, will, without a doubt, help us identify identity-based threats in our on-premises AD.

In the next chapter, we will look at how to manage MDI, how to interpret some of the alerts, and how to respond to MDI alerts.

Questions

You can test what you’ve learned about in this chapter by trying the following questions:

1. True or false: MDI identifies risky cloud-only account sign-ins.
   1. True
   2. False
2. Which of these is a primary advantage of using gMSAs instead of standard accounts?
   1. You can configure a gMSA using the command line and therefore automate it, which isn’t possible with standard accounts.
   2. Passwords are rotated automatically with gMSAs, unlike standard accounts.
   3. The MDI DSA doesn’t support standard user accounts, only gMSAs.
3. Which of the following should be configured to audit for event ID 8004?
   1. Recovery console: Allow floppy copy and access to all drives and folders
   2. Domain member: Disable machine account password changes
   3. Network security: Restrict NTLM: Audit Incoming NTLM Traffic
   4. System settings: Optional subsystems
4. What does Microsoft 365 Defender’s capability to action accounts contribute towards?
   1. Session policies
   2. Web content filtering
   3. Attack disruption
   4. Microsoft...

Further reading

There may be some specific scenarios regarding onboarding that this book has not discussed. You can find useful information on examples of these with the following links:

• To extend the support of MDI to ADFS, you can find some great support in the official documentation: learn.microsoft.com/en-us/defender-for-identity/active-directory-federation-services
• Similarly, you may want to extend auditing to Exchange objects if you have it integrated with AD: learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection#enable-auditing-on-an-exchange-object
• Few folks in the Microsoft community have as robust an understanding of MDI as Raymond Roethof MVP, and you can check out his excellent blog with a lot of MDI content (including tooling) at thalpius.com
• Building on top of a tool developed by Raymond to check MDI audit configuration is in place, William Francillette developed a useful PowerShell script: french365connection.co.uk/post...