Extend identity threat investigations to SailPoint-managed accounts
Connecting SailPoint Identity Security Cloud extends detection, investigation, and response across cloud and on-premises identity infrastructure.
Read the playbookDSE security knowledge hubCybersecurity
Cybersecurity
Knowledge
Page 143 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide Cybersecurity knowledge center
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
DSE post stream
1,892 articlesCybersecurity
Connect SailPoint with a dedicated API principal and least-required roles
The Defender portal API connector gives security administrators visibility into SailPoint-managed identities, identity-related threats, and account activity.
Read the briefing
Combine PAM access controls with Defender for Identity behavior analytics
PAM solutions can vault privileged credentials, control access through approval workflows, monitor sessions, and enforce just-in-time and just-enough-access policies.
Read the checklist
Use the identity inventory to triage accounts across on-premises, cloud, and SaaS systems
The identity inventory centralizes identities and exposes attributes such as identity type, domain, and tags for investigation and management.
Read the explainer
Inventory service accounts with their recent authentication context
Service accounts often have elevated privileges but generally cannot use modern authentication protections such as MFA in the same way as human accounts.
Read the guide
Read the Identity Security dashboard as posture and threat context, not proof of control
The dashboard presents data for analyzing security posture, protection, vulnerabilities, and recommended actions. Its graphs and widgets cover identity threat and response subjects including unauthorized access, account compromise, insider threats, and abnormal activity.
Read the playbook
Prioritize password risks in one cross-provider identity view
The Password protection page consolidates leaked credentials, exposed passwords, weak password policies, and configuration issues into a prioritized view.
Read the briefing
Review domain health, sensor coverage, policy, and trust relationships together
The Active Directory domain page brings domain health, sensor coverage, security policies, trust relationships, and recommendations into one view.
Read the checklist
Interpret Defender for Identity detections as correlated behavioral signals
Defender for Identity monitors signals from on-premises Active Directory, Microsoft Entra ID, and other IAM systems such as Okta, analyzing them with behavioral analytics, threat intelligence, and known attack patterns.
Read the explainer
Remove Entra Connect replication rights only when Password Hash Sync does not need them
The Microsoft Entra Connect express installation grants replication permissions to the AD DS Connector account, and Microsoft recommends removing unnecessary permissions when Password Hash Sync is not configured.
Read the guide