Managing Defender for Identity

In the previous chapter, we covered how to deploy Microsoft Defender for Identity (MDI). In this chapter, we will explore how to effectively manage and maintain Microsoft’s cloud-based identity protection solution, MDI. This solution is designed to help organizations protect their identities from various types of advanced cyberattacks, such as identity theft and unauthorized access.

The chapter covers key aspects of managing MDI, such as creating and managing policies and monitoring and responding to alerts. Additionally, the chapter provides insights into best practices for optimizing MDI performance and troubleshooting common issues. By following the instructions in this chapter, organizations can effectively manage Defender for Identity and ensure that their identity infrastructure is protected against advanced cyber threats.

The chapter will cover the following topics:

• Implementing role-based access control (RBAC)
• Managing...

Implementing RBAC

When MDI is configured in a tenant, the feature will automatically provide you with three role groups in Azure Active Directory (Azure AD). These, outside of the Azure AD roles that have permission to manage MDI settings, can help you govern access to the MDI workspace.

The Azure AD roles that have access as administrators in MDI are as follows:

• Global Administrator
• Security Administrator

The groups that are created once MDI is deployed are defined here:

• Azure ATP <tenant name> Administrators
• Azure ATP <tenant name> Users
• Azure ATP <tenant name> Viewers

Important note

The <tenant name> will be replaced by the display name of your tenant.

The Azure Advanced Threat Protection (ATP) groups have different levels of permissions toward MDI. While the Administrators groups can manage the MDI settings in full, the Users group has more limited access, and the Viewers group has read-only access to the...

Managing MDI security alerts

The different alerts in MDI aim to explain suspicious activities detected in the on-premises environment. The alerts can be categorized as follows:

• Reconnaissance phase alerts
• Compromised credentials phase alerts
• Lateral movement phase alerts
• Domain dominance phase alerts
• Exfiltration phase alerts

The alerts that are pre-configured in MDI are categorized using their MITRE ATT&CK ™ tactic as well, and the complete list of alerts can be found at learn.microsoft.com/en-us/defender-for-identity/alerts-overview#security-alert-name-mapping-and-unique-external-ids.

To manage these alerts, we need to head over to the Microsoft 365 Defender portal at security.microsoft.com. We then need to perform the following tasks:

1. Go to Incidents & alerts on the left-hand side of the screen and then to Alerts:

Figure 13.5 – The Incidents & alerts menu

2. To filter alerts from...

Managing MDI exclusions

There are three types of exclusion in MDI we can leverage to reduce false positives. All are managed from the Excluded entities section of Microsoft 365 Defender portal | Settings | Identities.

First up, let’s consider Global excluded entities. These are IPs, domains, devices, or users. These pretty much do what they say on the tin. If you want to stop these entities from appearing in any alerts, list them here. It should go without saying that you should proceed with caution: are you completely certain these entities couldn’t produce true positives?

Then, we have a more fine-grained approach: Exclusions by detection rule. This would ideally be used instead of the global option because we’re limiting our potential blind spots. Navigating to this setting, you’ll find the full list of MDI detection types and then the ability to add entities to exclude (only supported entities, varying by detection type). For example, the Suspicious...

Introducing entity tags

In MDI, we can use entity tagging to highlight sensitive accounts and honeytoken accounts. This improves our response by helping us prioritize. Let’s start with honeytokens.

Configuring honeytokens

These are decoy accounts set up to identify and trace suspicious activity where these accounts are in use. Honkeytoken accounts should be left unused while having an account name that is attractive to lure malicious outsiders or malicious insiders to use. For example, an account named AD-Admin would be interesting to try and use since the name implies privileges within AD.

In real life, though, the name of the account does not matter as the Security Identifier (SID) value of high privileged users or groups. The SID values in AD are always the following:

• S-1-5-domain-500 for the Administrator account in AD
• S-1-5-domain-512 for the Domain Admins group in AD
• S-1-5-root domain-518 for the Schema Admins group in AD
• S-1-5-root domain...

Managing MDI health issues

MDI has several health alerts that will be triggered if certain configuration options are no longer configured properly, were forgotten in the initial setup, or if communication and performance problems occur. For example, if MDI sensors identify no domain controller traffic is being received, if the sensor isn’t updating automatically, or if there are errors with event analysis. The list of detectable health issues is dynamic and changes as the product life cycle changes, so you may also receive notifications about end-of-life versions of Windows Server if a sensor runs on them.

These alerts, depending on severity, should be handled as soon as possible as they might impair MDI’s ability to successfully monitor the environment.

The health alerts in MDI can be accessed from the Security Portal available at security.microsoft.com | Settings | Identities | General and the Health issues part, as shown in the following screenshot:

...

Summary

This chapter has been all about managing MDI and its components. We have covered topics such as implementing RBAC for MDI, how to manage alerts, sensitive, honeytoken, and health alerts—anything an MDI administrator needs. And by making it to the end of this chapter, you should have enough knowledge to successfully manage your MDI instance in full.

MDI is a very capable tool, and we will circle back to MDI in Chapter 19 about Kusto Query Language (KQL) queries later in the book, where we will present examples of how to leverage MDI in your advanced hunting queries.

In the next chapter, we will move on to look at securing email with Exchange Online Protection and Microsoft Defender for Office 365.

Questions

As you work through this book, it’s useful to reflect on what you’ve learned and challenge yourself with questions. Here’s some on what we covered in this chapter:

1. Which of the following Azure AD groups isn’t provisioned as part of an MDI deployment?
   1. Azure ATP <tenant name> Administrators
   2. Azure ATP <tenant name> Viewers
   3. Azure ATP <tenant name> Responders
   4. Azure ATP <tenant name> Viewers
2. True or false: this book encouraged the use of PIM for Groups to manage MDI administrative access, but this is restricted to the Azure AD Premium P2 license.
   1. True
   2. False
3. Why are exclusions by detection rule preferred to global excluded entities, where possible?
   1. Exclusions by detection rule reduce blind spots in detections, compared to global excluded entities.
   2. Global exclusions do not support domains.
   3. Global exclusions are more difficult to set up.
4. Which of these isn’t a type of activity you’d find in an MDI security...

Further reading

You may refer to the following links to further your knowledge of the topics discussed in this chapter.

Microsoft’s official documentation has great reference material for the full list of alerts MDI may generate. If you see these types of alerts, you can read up on them here:

• Reconnaissance alerts: learn.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts
• Compromised credentials alerts: learn.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts
• Lateral movement alerts: learn.microsoft.com/en-us/defender-for-identity/lateral-movement-alerts
• Domain dominance alerts: learn.microsoft.com/en-us/defender-for-identity/domain-dominance-alerts
• Exfiltration alerts: learn.microsoft.com/en-us/defender-for-identity/exfiltration-alerts