Deploy the Defender for Identity sensor on domain controllers, AD FS, AD CS and Entra Connect servers, pick v2.x or the MDE-based v3.x sensor, set up the directory service account and audit policy, and run response actions from the Defender portal.
The Defender for Identity alert catalogue by kill-chain phase, what replaced lateral movement paths, entity tags, exclusions versus alert tuning, identity posture assessments, response actions and the action account, and the Identity* Advanced Hunting tables with ready KQL.
What Defender for Identity detects that an MDE-onboarded domain controller cannot, how the v3.x sensor rides on the MDE agent, what the classic v2.x sensor still does better, licensing, and a three-way comparison table.