Identity Threats: Entra & Defender for Identity

Why identity is the new perimeter

Entra ID: cloud identity threats

Common Entra ID risk detections

Detection	What It Means	Risk Level
Impossible travel	User signs in from New Zealand, then Germany 30 minutes later	High
Password spray	Multiple accounts targeted with common passwords	High
Unfamiliar sign-in properties	New device, new browser, new location	Medium
Anonymous IP	Sign-in from Tor, VPN, or anonymous proxy	Medium
Leaked credentials	User’s credentials found in a public breach database	High
Token theft	Adversary-in-the-middle attack stealing session tokens	High
Malicious IP	Sign-in from an IP associated with known attacks	High

Investigation workflow for compromised Entra ID accounts

1. Review the risk detection — what triggered it? (impossible travel, password spray, etc.)
2. Check sign-in logs — when, where, what device, what app
3. Check audit logs — did the attacker change anything? (MFA methods, email forwarding rules, app consent)
4. Check for lateral activity — did the account access other resources, send emails, or create apps?
5. Remediate:
   • Reset password
   • Revoke all refresh tokens and sessions
   • Re-register MFA (if MFA methods were modified)
   • Review and remove suspicious app consents
   • Check for inbox rules and mailbox forwarding

💡 Scenario: James investigates impossible travel

James at Pacific Meridian sees a High-risk alert: “Impossible travel — user signed in from Auckland NZ at 9:00 AM, then from Moscow at 9:15 AM.”

Investigation:

• Sign-in logs show the Moscow sign-in used a different device and browser
• The Auckland sign-in was the user’s normal work device
• Audit logs show the Moscow session changed the user’s MFA phone number and created a mail forwarding rule to an external address

This is a confirmed account compromise.

Remediation:

• Reset password immediately
• Revoke all sessions
• Remove the malicious MFA phone number and re-register the legitimate one
• Delete the forwarding rule
• Check if any sensitive emails were forwarded before detection
• Block the Moscow IP as an indicator

Defender for Identity: on-premises threats

Common MDI detections

Detection	Attack Technique	MITRE ATT&CK
LDAP reconnaissance	Attacker queries AD to map users, groups, and permissions	Discovery (T1087)
Kerberoasting	Request TGS tickets for service accounts to crack offline	Credential Access (T1558)
Pass-the-hash	Use stolen NTLM hash to authenticate without password	Lateral Movement (T1550)
Pass-the-ticket	Use stolen Kerberos ticket to impersonate a user	Lateral Movement (T1550)
DCSync	Impersonate a domain controller to replicate password hashes	Credential Access (T1003)
Suspicious service creation	Create a service on a remote machine for persistence	Persistence (T1543)
Honeytoken activity	Access to a decoy account designed to detect attackers	Early warning

Investigation workflow for MDI alerts

1. Review the MDI alert — what technique was detected? What accounts and devices are involved?
2. Check the attack timeline — MDI shows the sequence of activities on the entity page
3. Correlate with Entra ID — did the same user trigger cloud-side risk detections?
4. Check lateral movement paths — MDI maps potential lateral movement paths through the organisation
5. Remediate:
   • Reset the compromised account’s password
   • Rotate credentials for any service accounts involved
   • Check for persistence mechanisms (scheduled tasks, services, registry keys)
   • Review Group Policy for unauthorised changes

Entra ID covers cloud identity; MDI covers on-premises AD — use both for full coverage

Feature	Entra ID Protection	Defender for Identity
Environment	Cloud (Entra ID / Azure AD)	On-premises (Active Directory)
Detection method	Machine learning on sign-in telemetry	Network traffic analysis on domain controllers
Threats detected	Impossible travel, password spray, token theft, leaked creds	Kerberoasting, pass-the-hash, DCSync, LDAP recon, lateral movement
Data source	Sign-in logs, audit logs	Domain controller traffic (port mirroring or ADFS)
Remediation	Reset password, revoke tokens, re-register MFA	Reset passwords, rotate service account creds, check persistence
Integration	Feeds into Defender XDR incidents + Conditional Access	Feeds into Defender XDR incidents + Sentinel

💡 Exam tip: Entra ID Protection vs Defender for Identity

The exam tests whether you know which product handles which scenario:

• “User signs in from impossible location” → Entra ID Protection
• “Attacker performs pass-the-hash on domain controller” → Defender for Identity
• “Kerberoasting detected” → Defender for Identity
• “Leaked credentials found in public breach” → Entra ID Protection
• “Suspicious LDAP queries from a workstation” → Defender for Identity

Rule of thumb: if it involves sign-in behaviour or cloud tokens, it is Entra ID. If it involves AD protocols or domain controller traffic, it is MDI.

Question

What are the key remediation steps for a compromised Entra ID account?

Click or press Enter to reveal answer

Answer

1. Reset password. 2. Revoke all refresh tokens and sessions. 3. Re-register MFA if methods were changed. 4. Remove suspicious app consents. 5. Delete malicious inbox rules and forwarding. 6. Check for data access or email forwarding during the compromise window.

Click to flip back

Question

What is Kerberoasting and which product detects it?

Click or press Enter to reveal answer

Answer

Kerberoasting is an attack where an attacker requests Kerberos TGS tickets for service accounts and cracks them offline to obtain passwords. Microsoft Defender for Identity (MDI) detects this by monitoring abnormal TGS request patterns on domain controllers.

Click to flip back

Question

What is the difference between Entra ID Protection and Defender for Identity?

Click or press Enter to reveal answer

Answer

Entra ID Protection monitors cloud sign-in behaviour (impossible travel, password spray, token theft). Defender for Identity monitors on-premises Active Directory traffic (pass-the-hash, Kerberoasting, LDAP recon, lateral movement). Use both for full identity coverage.

Click to flip back

Knowledge Check

An Entra ID alert shows a user signed in from Auckland at 9:00 AM and from Moscow at 9:15 AM. The Moscow session changed the user's MFA phone number. What is the priority remediation action?

ABlock the Moscow IP addressBReset the password, revoke all sessions, and remove the malicious MFA methodCSend the user a warning emailDWait for AIR to complete the investigation

Check Answer

Knowledge Check

Defender for Identity detects Kerberoasting activity targeting a service account on Pacific Meridian's domain. What should James do?

ARotate the service account password immediately and set a long, complex passwordBDisable Defender for Identity — it is generating false positivesCBlock Kerberos traffic on the domain controllerDIgnore it — Kerberoasting only works on weak passwords

Check Answer

Next up: Identity threats are handled. Now let’s investigate shadow IT and risky cloud apps with Defender for Cloud Apps.