Page 144 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
The identity-infrastructure assessment includes a recommendation that identifies whether an Active Directory Guest account is enabled. The stated goal of that recommendation is for the domain Guest account not to be enabled.
Read the playbook
AD CS certificate enrollment can use the MS-ICPR RPC interface, whose certification-authority settings determine whether packet privacy is required.
Read the briefing
The assessment lists Group Policy objects that standard users can modify and states that this condition can lead to domain compromise. Microsoft notes that attackers can inspect Group Policy settings to identify weaknesses, security controls, and potential exploit paths.
Read the checklist
The stale-account recommendation lists Active Directory user accounts that have not logged in during the previous 90 days. The page says impacted entities can update within minutes after remediation while assessment scores and statuses update every 24 hours.
Read the explainer
Defender for Identity provides cloud-identity assessments for Okta, CyberArk Identity, and SailPoint Identity Security Cloud. Microsoft requires the relevant provider instance to be connected in the Defender portal before its assessments are used.
Read the guide
Defender for Identity alerts describe suspicious activities and identify involved actors and computers with direct evidence links.
Read the playbook
Classic and Defender-format alerts use detections from Defender for Identity sensors but differ as part of the transition to a unified alerting experience.
Read the briefing
Classic and Defender formats use the same underlying Defender for Identity sensor detections but differ in structure, naming, and categorization. Alert names differ in the XDR structure while alert IDs remain consistent between the two formats.
Read the checklist
By default, the alerts queue shows alerts seen in the previous seven days in a grouped view with the newest alerts first. The documented workflow covers viewing, filtering, investigating, classifying, and managing Defender for Identity security alerts.
Read the explainer
Defender for Identity monitors information from Active Directory, network activities, and event activities to detect suspicious activity. For a validated threat, the monitored information can help determine incident scope, involved entities, and remediation.
Read the guide