# Include learning periods and complete attack stories in Defender for Identity tests > Use Best Practices before Offensive Security Testing for Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope. - Canonical URL: https://update.dsesecurity.com/updates/include-learning-periods-complete-attack-stories-identity-tests/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-27T12:15:06+00:00 - Modified: 2026-08-27T12:56:25+00:00 - Last reviewed by DSE: 2026-08-26 - Resource type: Playbook - DSE priority: Advisory - Topics: Cybersecurity, IT, Microsoft 365 & Identity - Reading time: 3 minutes ## What you need to know Use Best Practices before Offensive Security Testing for Microsoft Defender for Identity to review this narrow operational decision without extending the source beyond its stated scope. ## Potentially affected Teams, systems, services, or facilities within the stated scope of Best Practices before Offensive Security Testing for Microsoft Defender for Identity ## DSE recommendation Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards. ## Article Keep this document to one review outcome: Include learning periods and complete attack stories in Defender for Identity tests. Only the official source and traced locations below supply facts. Confirm applicability before acting. ## Source fact: The official [Best Practices before Offensive Security Testing for Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/security-testing-best-practices) from Microsoft supports the following bounded statements: - Defender for Identity alert learning periods tune detections, and testing without the needed learning period reduces detection accuracy. The research record locates this support at Common issues that affect testing > Detection accuracy issues > Insufficient learning period. - Microsoft recommends testing actual attack scenarios instead of single TTPs because detections focus on complete attack stories and one kill-chain segment produces incomplete results. The research record locates this support at Common issues that affect testing > Configuration issues > Incomplete attack simulation. - Some penetration-testing tools can return false results, so Microsoft directs testers to cross-check the relevant audit logs to confirm that an attack succeeded. The research record locates this support at Common issues that affect testing > Configuration issues > Incompatible penetration testing tools. These statements are the factual basis for this document. Do not extend them into a broader assurance. Review identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows only where the source and recorded environment align. ## What the source does not establish Run only authorized, controlled testing; the guidance does not guarantee a specific alert, validate every tool, or replace attack-specific learning-period checks. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing before translating the source into an operational decision. ## Applicability questions - For source statement 1 at Common issues that affect testing > Detection accuracy issues > Insufficient learning period, which observable configuration, record, or test can confirm applicability here? - For source statement 2 at Common issues that affect testing > Configuration issues > Incomplete attack simulation, which observable configuration, record, or test can confirm applicability here? - For source statement 3 at Common issues that affect testing > Configuration issues > Incompatible penetration testing tools, which observable configuration, record, or test can confirm applicability here? - What inventory proves which parts of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows are in and out of scope? - Which condition in Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing must be healthy before evidence is trustworthy? - What result would disprove the working assumption and return the issue to the owner? ## DSE recommendation: DSE recommends using the cited source as the evidence anchor for this decision. Start with applicability, then compare the observed state with the cited source. Record the source location, examined part of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows, observed and expected states, owner, and reason for deviation. If the review warrants change, use a bounded implementation with prerequisites, test population, monitoring, abort criteria, and a rehearsed reversal. Sequence checks for Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing and sanitize protected material before retention. ## Verification and evidence Build a reproducible chain from Common issues that affect testing > Detection accuracy issues > Insufficient learning period; Common issues that affect testing > Configuration issues > Incomplete attack simulation; Common issues that affect testing > Configuration issues > Incompatible penetration testing tools to the observed environment. Useful domain evidence includes alert records, investigation timelines, analyst actions, tuning or exclusion approvals, remediation results, and case closure; label every item with scope, timestamp, collector, and stable identifier. Preserve both successful and failed observations, along with approval and rollback evidence. Avoid uncontrolled production experiments. Assign an expiry or event-driven recheck so the conclusion is not treated as permanent. ## Official references - [Best Practices before Offensive Security Testing for Microsoft Defender for Identity](https://learn.microsoft.com/en-us/defender-for-identity/security-testing-best-practices) — Microsoft ## Primary reference - Name: Best Practices before Offensive Security Testing for Microsoft Defender for Identity - Authority: Microsoft Learn - URL: https://learn.microsoft.com/en-us/defender-for-identity/security-testing-best-practices - Source publication date: 2026-01-26 ## Citation and use Preferred citation: “Include learning periods and complete attack stories in Defender for Identity tests,” DSE Security, https://update.dsesecurity.com/updates/include-learning-periods-complete-attack-stories-identity-tests/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.