Use the identity inventory to triage accounts across on-premises, cloud, and SaaS systems

Frame this document as a source-led configuration and assurance check: Use the identity inventory to triage accounts across on-premises, cloud, and SaaS systems. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official View the Identity inventory from Microsoft supports the following bounded statements:

• The identity inventory centralizes identities and exposes attributes such as identity type, domain, and tags for investigation and management. The research record locates this support at Opening overview.
• Enabling the Defender for Cloud Apps integration adds SaaS and cloud application accounts and supports unified identity timelines, correlation, response, and protection experiences. The research record locates this support at Integration paragraph.

The source support ends with the statements listed above. Use them to examine identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows in the applicable environment, not to imply a wider guarantee.

What the source does not establish

The source notes that some Defender for Cloud Apps pipelines remain separate, so correlations do not affect every listed capability. No current deployment state or change approval follows from the source alone. Validate Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing, and treat examples or options as conditional inputs rather than defaults.

Applicability questions

• For source statement 1 at Opening overview, which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Integration paragraph, which observable configuration, record, or test can confirm applicability here?
• Which deployed instance of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows will be compared with the source, and why that instance?
• How will the review distinguish a source mismatch from a failure in Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing?
• Who approves the conclusion, exception, test window, and rollback threshold?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Make the source, asset scope, owner, and expected outcome explicit in the review record. Record the source location, examined part of identity alerts, investigations, remediation roles, evidence retention, escalation, exclusions, and incident workflows, observed and expected states, owner, and reason for deviation.

An implementation decision needs an owner, approved window, prechecks, observable outcome, stop authority, and rollback path. Validate Active Directory, Windows DNS, time, cloud portals, endpoint data, network telemetry, privileged access, and response staffing before and after the test, and store only sanitized operational evidence.

Verification and evidence

Evidence should let another reviewer reproduce this decision. Retain observations beside the traced locations Opening overview; Integration paragraph. Favor alert records, investigation timelines, analyst actions, tuning or exclusion approvals, remediation results, and case closure, linked to stable identifiers, time, and operator.

Close the review only when the evidence, exception handling, resulting action, and after-state are linked. Schedule a new review after material technical, organizational, incident, or source changes; today’s observation is not a continuing guarantee.

Official references

• View the Identity inventory — Microsoft