Let's go out to Edge here, and I've already signed into the portal.
Now you would need to sign up for Microsoft Defender for Identity,
and once you have an account or you have a license,
you then can sign into the MDI portal,
which is going to be the name of your tenant,
in my case, it's timwinfo.atp.azure.com.
So it functions along the same lines as Azure,
but remember that our point here, at least for the purpose of this lesson,
is using Microsoft Defender for Identity to onboard our on‑premises
Active Directory domains and receive proactive guidance,
notifications, alerts, reports, health status from the service.
Let's actually take a look at the timeline here because I've had this set up
in my lab environment in the past for a little while anyway enough to where
you can see some alerts just a little bit about how the UI behaves in the
Microsoft Defender for Identity console.
So here you can see it uses an issue format where you've got issues
that are in different states just like you would in your IT Help
Desk or in your Azure DevOps project, whatever the case might be.
You can share the alerts, you can delete it,
you can change its state, but this is giving me some pretty scary ideas here.
It's saying that Tim Warner,
so it's telling you who made whatever operation it is that flagged the alert,
is running commands remotely on DC1 from MEM1 using PowerShell.
Well, let's see if we can get some more details on that.
We can download the details.
This is just giving us a brief summary.
Let's go over to Reports and let's change the view here.
We'll bring it back a little bit,
and we can download just a summary of alerts and health issues.
It looks like it's coming down as an Excel file.
I don't have Excel on my system.
The good news is that because that's an Excel file,
it should make it a lot easier to do whatever
transformations you might need on that data.
Let's see, in the system Health,
this is giving us data on the back end of things.
Remember,
I explained that the way you onboard your on‑premises domain
controllers into MDI is by installing a sensor on it.
In fact, you download the sensor separately,
although actually, it occurs to me you can get to the sensors right from here,
right from this portal.
So it's just giving you some health information on the connectivity between
MDI that runs in the cloud and your on‑premises environment.
Yeah, I'm wondering why I must be missing something fundamental here.
Why I'm not able to see the details of this report here.
Well let me take a look.
If we try to drill into a machine, there we go.
Yeah, so if we try to drill into one of our domain controllers,
I have one here called DC1,
this looks like it's giving us some more details here,
right.
So once we get to the Details page for an alert,
I really like how it gives you hyperlinks because the tool is aware of
all of your Active Directory account credentials.
This is an account with a SAM name of Tim,
as you can see tim@contoso.com,
and because I've onboarded some domain machines here,
a domain controller and a member server,
those are also registering.
Now in the case of external attackers or sensitive
alert data that's come from outside,
there you'll be able to trace IP addresses rather than identities.
So let me see here.
If we can continue to click, it's telling us that I did some PowerShell,
and eventually,
we can get down under evidence here and see exactly
what I ran that triggered the alert.
Now this could be useful from a couple perspective.
For one thing, it could be part of a legitimate investigation,
but another thing is that this could be benign traffic,
which actually, in this case it is benign,
which means that you can then go into Configuration and configure
exemptions so you don't see these alerts happen over and over.
You want to bring your signal to noise ratio into a good alignment.
So lastly, let's go to Configuration here,
and specifically,
I want to go over to Sensors because this is where you're going to make
that connection with your on‑premises environment.
What you'll do is you'll download the sensor setup executable,
and when you run that setup on one of your on‑premises domain controllers,
you'll need to provide the access key that you've got here.
It's basically an API key that you want to periodically
regenerate so that if it is leaked,
you don't have any rogue servers showing up in your MDI instance.
It looks like the ATP sensor setup comes down as a zip about 82,
83 MB, nothing too dramatic.
Here is where we can authenticate specifically into our connected domain.
Here is where we have some integration or at least an option for
integrating Microsoft Defender for Endpoint.
This is a theme that I've mentioned a couple of times in the
training that these Microsoft Defender products are meant to
integrate with each other wherever possible.
So I think that's about all we need to understand
about Microsoft Defender for Identity.
I just wanted to go a bit beyond explaining what it is in its use
case and show you the portal just so you can have more of a
visual in your mind so that you'll be more confident yet when you sit and clear Exam AZ‑801.