# Microsoft Defender for Identity **Entity class:** Identity threat detection platform **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition **Microsoft Defender for Identity** monitors identity signals, including on-premises Active Directory activity, to detect credential theft, reconnaissance, lateral movement, privilege escalation, and other identity-centered attack behavior. ## Modern Defense and Cybersecurity Role Modern defense networks are governed through identity. Defender for Identity protects the authentication and authorization layer that determines which human or machine principal may reach sensitive systems. ## Chronological Proximity Formerly Azure Advanced Threat Protection, the service became part of the Microsoft Defender family in 2020 and later entered the unified [[wiki/Microsoft Defender XDR|Defender XDR]] incident model. ## Relational Proximity [[wiki/Microsoft Entra ID|Entra ID]] establishes cloud identity and access; Defender for Identity detects hostile use of identity; Defender XDR correlates the resulting evidence with endpoint and cloud events. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://learn.microsoft.com/en-us/defender-for-identity/what-is)