In order to get started with Microsoft Defender for Identity,
you will need to navigate to the Microsoft 365 Defender portal.
Within the portal, on the left‑hand side,
as you scroll down to Settings, you will then select Identities.
This will take you to the configuration for Microsoft Defender for Identity.
The very first option that you have is the Sensors option,
and this is where you can actually download the Sensors software.
So as I click on Add sensor, I have a link for the installer.
And then I have an Access key,
which you will need to use when you perform the installation.
So I'm going to go ahead and copy this Access key,
and I've already downloaded the installer,
so I'm going to switch to my domain controller,
where I would need to install the sensor.
All right, so now I've switched to my domain controller,
and I'm going to go ahead and install the Sensor.
As I click Next on the setup page, I get an option for a Sensor deployment type.
Now because I'm running this on a virtual machine,
I can only install the Sensor locally under domain controller.
If you were running this on your production environment,
you would have options to install this as a
Standalone Sensor or as an ADFS Sensor.
All of these deployment types you will find in the Microsoft documentation,
which is listed in the more information section of this course.
So I'll go ahead and click on Next.
And now I would need to populate the Sensor Access key,
this is the one that I've just copied,
and I will go ahead and install the Sensor.
Right, so as the installation has completed successfully,
I'm going to switch back to the Microsoft 365 Defender portal.
All right, so now that we've got our Sensor installed,
the next thing that we need to do is configure a directory service account.
Now this account does not need to be a privileged account,
essentially, it can be a standard user account,
and all that it's going to be doing is allow the Sensor and the Defender
for Identity cloud service to query Active Directory.
This will enable Defender for Identity to get details about the
users in your Active Directory environment.
Now you can also make use of a group‑managed service account.
To add the credential, it's pretty straightforward.
As you click on Add credentials,
you essentially need to populate the credential name,
the domain, and the password.
Now you can leverage an action account, and essentially,
this account has capabilities to perform actions on users.
So for example, if you wanted to disable a user,
reset a user's password, then this account would be used.
For now, I'm not going to define any action accounts,
and I'm going to move on to the rest of the settings.
The VPN tab allows you to configure any type of RADIUS
accounting if you wanted to enrich your entity profiles
with information from your VPN.
Health issues would essentially show you any information
related to the health of the servers.
Portal redirection is where you can redirect access from the old Azure
ATP portal to the new Microsoft 365 Defender portal.
Now the rest of the configuration options that we have
allow us to configure entity tags,
which essentially allows us to define various types of
accounts that can be marked as sensitive.
As you can see here,
I have marked some of the key accounts as sensitive accounts.
This means that if these accounts are flagged for any detections,
we will know that they are sensitive because they will have
a sensitive badge next to the account.
I can also go ahead and define any type of Honeytoken accounts,
and these will trigger alerts if activity is seen related to these accounts.
The same applies for Exchange servers,
where I could define this as a high‑failure asset.
From an Excluded entities perspective, I can go and define Users,
Domains, Devices, and IP addresses in an exclusion range.
Ultimately, I can leverage these exclusions for different types of detections.
So for example, if I know a certain account,
perhaps a service account,
has a lot of access to different types of servers and I wanted to
stop it from being flagged for lateral movement,
I could exclude that account from a detection rule.
Under Notifications, this is where we will see Health issue notifications,
and we can configure these notifications to be sent via email.
The same applies for Alert notifications and Syslog service
integration if we wanted to leverage it for the alerts.
Now that concludes the set up of Microsoft Defender for Identity.
Because Defender for Identity has so much of capability,
it's impossible to fit it in a single video,
let alone in a single module.
You'll see in the summary video of this module, I link an additional course that focuses purely on Defender for Identity.