Page 243 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
Defender for Identity supports tagging accounts as sensitive or honeytokens and tagging devices as Exchange servers. Some detections depend on the sensitive tag, while any sign-in from a tagged honeytoken account triggers an alert.
Read the explainer
Custom correlation rules target accounts that do not share strong identifiers such as account ID, SID, object ID, or UPN.
Read the guide
Defender for Identity notifications are supported only by sensor v2.x. The service can notify on health issues and security alerts through email or a Syslog server.
Read the playbook
Some Defender for Identity alerts use learning periods to build activity profiles and distinguish legitimate from suspicious behavior.
Read the briefing
The known-issues page documents a sensor warning when an LDAP connection cannot retrieve a group managed service account password. For that documented issue, Microsoft identifies the cause as the domain controller lacking rights to access the gMSA password.
Read the checklist
Defender for Identity logs provide point-in-time insight into sensor activity and status. The Microsoft.Tri.Sensor.log records sensor operations, resolution, and errors in chronological order and is used for an overall operational view.
Read the explainer
Microsoft’s daily guide covers identity dashboard review, incident triage, alert tuning, proactive hunting, and deployment-health monitoring. The stated operating personas include SOC analysts, security administrators, and identity and access management teams.
Read the guide
Microsoft’s weekly guide calls for reviewing Secure Score recommendations, responding to emerging threats with custom detections, and proactive threat hunting.
Read the playbook
Under 29 CFR 1910, the rule requires that the employer ensure hazardous conditions on walking-working surfaces are corrected or repaired before an employee uses the walking-working surface again.
Read the briefing
Under 29 CFR 1910, the rule requires that more than two exit routes be available in a workplace if the number of employees, the size of the building, its occupancy, or the arrangement of the workplace is such that all employees would not be able to evacuate safely during an emergency.
Read the checklist