Page 240 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
The identity inventory centralizes identities and exposes attributes such as identity type, domain, and tags for investigation and management.
Read the explainer
Service accounts often have elevated privileges but generally cannot use modern authentication protections such as MFA in the same way as human accounts.
Read the guide
The dashboard presents data for analyzing security posture, protection, vulnerabilities, and recommended actions. Its graphs and widgets cover identity threat and response subjects including unauthorized access, account compromise, insider threats, and abnormal activity.
Read the playbook
The Password protection page consolidates leaked credentials, exposed passwords, weak password policies, and configuration issues into a prioritized view.
Read the briefing
The Active Directory domain page brings domain health, sensor coverage, security policies, trust relationships, and recommendations into one view.
Read the checklist
Defender for Identity monitors signals from on-premises Active Directory, Microsoft Entra ID, and other IAM systems such as Okta, analyzing them with behavioral analytics, threat intelligence, and known attack patterns.
Read the explainer
The Microsoft Entra Connect express installation grants replication permissions to the AD DS Connector account, and Microsoft recommends removing unnecessary permissions when Password Hash Sync is not configured.
Read the guide
The identity-infrastructure assessment includes a recommendation that identifies whether an Active Directory Guest account is enabled. The stated goal of that recommendation is for the domain Guest account not to be enabled.
Read the playbook
AD CS certificate enrollment can use the MS-ICPR RPC interface, whose certification-authority settings determine whether packet privacy is required.
Read the briefing
The assessment lists Group Policy objects that standard users can modify and states that this condition can lead to domain compromise. Microsoft notes that attackers can inspect Group Policy settings to identify weaknesses, security controls, and potential exploit paths.
Read the checklist