Page 239 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Defender for Identity sensors parse specific Windows event logs from domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers, which must have the correct advanced audit policy settings.
Read the explainer
Portal-based migration from sensor v2.x to v3.x automatically completes switchover while retaining server configuration and monitoring without downtime or duplicate data.
Read the guide
A first sensor activation can take up to an hour to show as Running, while subsequent activations can appear within five minutes. Microsoft directs administrators to confirm Defender for Identity events on the device timeline and user data for the newly onboarded domain.
Read the playbook
After connection, CyberArk identity data is added to the identity inventory and correlated with on-premises Active Directory and Microsoft Entra identities.
Read the briefing
The connection uses connector APIs to provide Defender for Identity visibility into and control over CyberArk identities. Microsoft requires the documented CyberArk role plus Microsoft Entra or Defender role-based access permissions before connection.
Read the checklist
Defender for Identity ingests Okta user and activity data and correlates it with identity data from Active Directory and Microsoft Entra ID. The integration provides a centralized view of user activity, posture risks, and suspicious behavior and supports remediation actions.
Read the explainer
The connector collects Okta system logs once and shares them with supported Microsoft security products to reduce API use and duplicate collection.
Read the guide
Connecting SailPoint Identity Security Cloud extends detection, investigation, and response across cloud and on-premises identity infrastructure.
Read the playbook
The Defender portal API connector gives security administrators visibility into SailPoint-managed identities, identity-related threats, and account activity.
Read the briefing
PAM solutions can vault privileged credentials, control access through approval workflows, monitor sessions, and enforce just-in-time and just-enough-access policies.
Read the checklist