Try our new research platform with insights from 80,000+ expert users

Microsoft Defender for Identity vs Microsoft Entra External ID comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Microsoft Defender for Iden...
Ranking in Microsoft Security Suite
7th
Average Rating
8.8
Reviews Sentiment
7.8
Number of Reviews
17
Ranking in other categories
Advanced Threat Protection (ATP) (5th), Identity Threat Detection and Response (ITDR) (1st)
Microsoft Entra External ID
Ranking in Microsoft Security Suite
32nd
Average Rating
7.4
Number of Reviews
3
Ranking in other categories
Identity and Access Management as a Service (IDaaS) (IAMaaS) (19th), Customer Identity and Access Management (CIAM) (11th)
 

Mindshare comparison

As of November 2024, in the Microsoft Security Suite category, the mindshare of Microsoft Defender for Identity is 7.8%, up from 4.7% compared to the previous year. The mindshare of Microsoft Entra External ID is 0.4%, up from 0.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Microsoft Security Suite
 

Featured Reviews

Sachin Vinay - PeerSpot reviewer
Easily detects advanced attacks based on user behavior
The best feature is security monitoring, which detects and investigates suspicious user activities. It can easily detect advanced attacks based on the behavior. The credentials are securely stored, so it reduces the risk of compromise. It will monitor user behavior based on artificial intelligence to protect the identities in your organization. It will even help secure the on-premise Active Directory. It syncs from the cloud to on-premise, and on-premise modifications will be reflected in the cloud. Identity harvesting is the most common threat. Legacy Microsoft solutions and Amazon face the same issues in the cloud. Users don't implement other security mechanisms in the cloud. In an on-premise environment, we would have multiple security devices like firewalls and several layers of security. Cloud users are less bothered because cloud features are there and only need to be configured. Microsoft Defender for Cloud is the best solution because all threats are completely visible, and it has a great dashboard. The dashboard displays each threat and score, so we can identify the threat rating and act efficiently to avoid compromising user identities. We have a single sign-on feature on the cloud. If we lose a single set of identities, it can compromise the entire organization, including cloud and on-premise. The same identities are being used everywhere. The user activity has to be completely visible on the dashboard, and it has to generate a pattern. It will notify us if there is any security breach. It is a complete monitoring set. Minor changes in the user identity can lead to data leakage. If a password is changed in the cloud, it will be reflected automatically in the on-premise. This minor change will trigger an alert in Microsoft Defender for Identity. It ensures that each cloud identity is well protected from spoofing. It has a comprehensive database of well-known spoofing techniques, enabling us to provide cloud identity protection completely. It has a vast scope because it is completely single sign-on. In the emerging industry, we use single sign-on because users need to authenticate, but it's challenging to remember multiple passwords. Once your user signs in, you can access all the data. An identity compromise would lead to various issues and affect the data on-premises. Defender maintains a constantly updated database with the latest signatures, attack models, and threats. If it detects one threat, it will monitor the suspicious event and give us frequent alerts. Identity protection is vital because we use an identity mechanism for everything, including firewall-related activities. The exact identity used in the cloud is used in the most complex firewalls. We require an excellent migration technique to regain this user credential if something gets compromised. Blocking this requires a massive set of procedures. Microsoft Defender comprehensively monitors identity and provides frequent alerts regarding any issue, so we don't need to think of anything else. Defender's bidirectional sync capabilities are helpful because we need to sync data from multiple directions, including tenant-to-tenant, on-premise-to-cloud, and cloud-to-cloud syncing. As a university, we have multiple tenants, so we need to sync or access data across platforms. That way, everything is more secure, and Microsoft Defender for Cloud also provides ample security for cloud transfers. The bidirectional sync capabilities are flawless—10 out of 10. Our on-premise Active Directory is perfectly synced with the Azure AD. Everything is synced with on-premise, and changes are reflected in minutes. If a problem with identity is addressed on the cloud, the fix will be mirrored on-premise and vice versa. Microsoft Defender for Cloud and Identity are bundled. If we have these two solutions, we don't need to worry about anything else or third-party antivirus. Microsoft Defender for Identity acts as a link to all the Microsoft security features that require identity-based validation. Microsoft Defender instantly provides identity security for all our applications, and users need not worry about typing their passwords. Even in situations with less complex encryption mechanisms, users don't need to worry about typing in their passwords. Defender will check and monitor if there are any flaws in that, and it will let us know if there are any issues. We're a Microsoft shop, so everything works together. If one feature isn't working, everything will be affected. If Defender isn't working, half of our Microsoft security features will be dead. Without identity security, user data can easily be compromised, and data can fall into the hands of intruders or other hackers. The solutions have to complement each other. If anything got wrong, the entire setup would have flaws. Microsoft security has a legacy security mechanism. A while back, we might have gone with Defender for Endpoint, but Microsoft has also grown into the face of the cloud. The same Defender solution is completely maintaining cloud security. We can imagine Microsoft's vast scale and how Defender can protect the cloud environment from vulnerabilities and attacks. We are definitely delighted with Microsoft products. The dashboard features are fantastic because it provides a comprehensive overview. It has a great alert mechanism and log inspector that tracks when users access various servers. With this kind of identity validation, we can control which servers the users can access. We have total visibility from the dashboard. We can track identity usage even if there are no issues. That is an essential advantage.
Oluwakorede Oladipo - PeerSpot reviewer
Promotes centralized user management and easy to setup
The most beneficial feature for us is the ease of setup. With about five clicks, we can generate unique IDs and keys and set up in less than 30 minutes. We can also generate these for multiple years simultaneously, which is convenient. In Azure, you can set up access rules. Just because an app is linked to Active Directory doesn’t mean everyone can access it automatically. You can make it so users have to give consent before getting access. You can also control which apps can connect to Active Directory. For Microsoft Exchange, we use multi-factor authentication to protect our information, which helps keep it secure by requiring more than just a password to log in. Centralizing user management has positively impacted our operational costs and efficiency. We no longer need multiple systems to manage users, especially in our SaaS applications. This has improved turnaround time for user management tasks and streamlined our processes, making things more efficient. We use the SaaS version, so there's no on-premises infrastructure. The integration is mainly done through setup, linking it to our domain and Active Directory.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features of Microsoft Defender for Identity include real-time information for threat detection, its inclusion of behavioral analytics, and vulnerability management."
"The feature I like most is that you can create your own customized detection rules. It has a lot of default alerts and rules, but you can customize them according to your business needs."
"The basic security monitoring at its core feature is the most valuable aspect. But also the investigative parts, the historical logging of events over the network are extremely interesting because it gives an in-depth insight into the history of account activity that is really easy to read, easy to follow, and easy to export."
"This solution has advanced a lot over the last few years."
"It automates routine testing and helps automate the finding of high-value alerts."
"Defender for Identity has not affected the end-user experience."
"The solution’s alerting is fairly efficient."
"It is easy to set up. Based on the number of devices you would like to set up, you can use scripts, Group Policy, etc. It takes five minutes to set up."
"The most beneficial feature for us is the ease of setup. With about five clicks, we can generate unique IDs and keys and set up in less than 30 minutes. We can also generate these for multiple years simultaneously, which is convenient."
"It's quite easy to manage and monitor."
"It's similar to using a Microsoft account to create accounts on other websites. We are also using Microsoft Entra to monitor which applications our guests are using. This allows us to filter, block, or adjust permissions for these applications as needed for our collaborators."
 

Cons

"And when you are working in a priority IP address, Identity is not able to know that those IPs are from the company. It sees that the IPs are from Taiwan or from Hong Kong or from India, even though they are internal IPs, resulting in a lot of false positives."
"We observe a lot of false positives. Sometimes, when we go for a coffee break, we lock our screens. Locking the screen has a separate Windows event ID and sometimes I see it is detected as a failed login."
"The tracking instance needs to be configured appropriately."
"The solution could improve how it handles on-premises Android-related attacks."
"The solution could be better at using group-managed access and they could replace it with broad-based access controls."
"The impact of the sensors on the domain controllers can be quite high depending on your loads. I don't know if there's any room for improvement there, but that's one of the things that might be improved."
"The technical support needs significant improvement. Documentation for more minor issues in the form of guides or walkthroughs could help to resolve this issue. The number of tickets raised would decrease, removing some pressure from the support team and making it easier to clear the remaining tickets."
"An area for improvement is the administrative interface. It's basic compared to other administrative centers. They could make it more user-friendly and easier to navigate."
"Technical support needs improvement."
"The problem with Microsoft products is that they often cater to enterprise-level needs, which can be too costly for medium-sized businesses."
"I would like to see faster synchronization."
 

Pricing and Cost Advice

"The product is costly, and we had multiple discussions with accounting to receive a discounted rate. However, on the open market, the tool is expensive."
"Microsoft Defender for Identity comes as part of the Microsoft E5 licensing stack."
"Defender for Identity is a little more expensive than other Microsoft products. Identity and Microsoft Defender for Cloud are both a bit costly."
"It is very affordable considering that other SIEM solutions are much more expensive and have many more licensing restrictions and fees."
"You won't be able to change your tenants from where you deploy them. For example, if you select Canada, they will charge you based on Canadian pricing. If you are also in London, when you deploy in Canada, the pound is higher than Canadian dollars, but your platform resources are billable in Canadian dollars. Using your pounds to pay for any of these things will be cheaper. Or, if you deploy in London, they will charge you based on your local currency."
"We don't pay separately for Microsoft Entra External ID as it's part of our Microsoft Exchange subscription."
report
Use our free recommendation engine to learn which Microsoft Security Suite solutions are best for your needs.
816,660 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
14%
Financial Services Firm
14%
Government
9%
Manufacturing Company
7%
Computer Software Company
19%
Financial Services Firm
10%
Manufacturing Company
10%
Healthcare Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about Microsoft Defender for Identity?
Microsoft Defender for Identity provides excellent visibility into threats by leveraging real-time analytics and data intelligence.
What needs improvement with Microsoft Defender for Identity?
The solution could improve how it handles on-premises Android-related attacks. Without Microsoft Defender, it can be challenging to check which accounts are compromised and to analyze activities on...
What is your primary use case for Microsoft Defender for Identity?
We use Microsoft Defender for Identity to prevent user account-level attacks such as lateral move attacks and pass-the-hash attacks on our on-premises servers. We leverage its features to mitigate ...
What is your experience regarding pricing and costs for Microsoft Entra External ID?
It's quite expensive, especially as you grow and add more users. Initially, with a small number of people, the costs were manageable.
What needs improvement with Microsoft Entra External ID?
The problem with Microsoft products is that they often cater to enterprise-level needs, which can be too costly for medium-sized businesses. When you move beyond a small team and start growing, the...
What is your primary use case for Microsoft Entra External ID?
We had a project to integrate our Active Directory, which was running on our site, and invite external collaborators, such as freelancers, to connect to our domain via an invitation. Additionally, ...
 

Also Known As

Azure Advanced Threat Protection, Azure ATP, MS Defender for Identity
Azure Active Directory External Identities
 

Learn More

Video not available
 

Overview

 

Sample Customers

Microsoft Defender for Identity is trusted by companies such as St. Luke’s University Health Network, Ansell, and more.
Information Not Available
Find out what your peers are saying about Microsoft Defender for Identity vs. Microsoft Entra External ID and other solutions. Updated: October 2024.
816,660 professionals have used our research since 2012.