Ask a client on Microsoft 365 whether they need identity threat detection and you’ll often hear the same answer: “Doesn’t Microsoft already do that?” Partly, yes. Microsoft has real ITDR tools. But which ones a client actually has, and what they can see, depends on their licences and on how their tenant is set up.
This post explains what Microsoft ITDR is made of, what each part watches, the licences it needs, and the gaps MSPs should check before telling a client they’re covered.
What is Microsoft ITDR?
ITDR (identity threat detection and response) watches sign-ins and account activity for signs that someone other than the real person is using an account, and acts when they are. Read what is ITDR for the full picture.
Microsoft doesn’t sell one product called “Microsoft ITDR”. It’s two main tools that now meet in the Microsoft Defender portal:
- Microsoft Defender for Identity, which watches on-premises Active Directory.
- Microsoft Entra ID Protection, which scores the risk of cloud sign-ins and users in Microsoft Entra ID, the sign-in behind Microsoft 365.
Microsoft Learn describes an identity security dashboard (in preview) in the Defender portal that brings alerts from both together. Microsoft has also extended its identity coverage to some other identity providers through connectors.
Microsoft Defender for Identity: what it watches
Defender for Identity uses signals from on-premises Active Directory. Per Microsoft Learn, its sensors are installed on domain controllers and on AD FS, AD CS and Microsoft Entra Connect servers. From there it looks for things such as:
- Reconnaissance against the directory.
- Attacks on passwords and Kerberos tickets.
- Movement from one machine or account to another.
- Changes to sensitive groups and accounts.
That makes it strong where a business still runs its own domain. It’s built for the networks most mid-sized and large companies have, where Active Directory and Entra ID are synced.
Licence: Microsoft Learn lists Defender for Identity as part of Enterprise Mobility + Security E5, Microsoft 365 E5 and Microsoft 365 E5 Security, or as a standalone licence. It isn’t in Microsoft 365 Business Premium. Business Premium customers can add it through Microsoft’s Defender Suite add-on.
Microsoft Entra ID Protection: what it watches
Entra ID Protection works on cloud sign-ins. It scores each sign-in and each user for risk, using signals such as leaked credentials, unfamiliar sign-in properties, anonymous IP addresses and impossible travel. With the right licence you can then act on that score automatically, for example by requiring MFA or a password change through risk-based Conditional Access.
Licence: Risk-based Conditional Access needs Microsoft Entra ID P2. Microsoft 365 Business Premium includes Entra ID P1, not P2. Without P2, Microsoft Learn notes that the detail you can see about risky sign-ins and users is limited. P2 also comes with Microsoft 365 E5, or through the Defender Suite add-on for Business Premium.
What each tool covers, side by side
| Defender for Identity | Entra ID Protection | |
|---|---|---|
| Watches | On-premises Active Directory | Cloud sign-ins and users in Entra ID |
| Needs | Sensors on domain controllers and identity servers | Entra ID P2 for full detail and risk-based policies |
| Included in Business Premium? | No | Partly (P1 only, limited risk detail) |
| Included in Microsoft 365 E5? | Yes | Yes (P2) |
| Best fit | Hybrid businesses with their own domain | Every Microsoft 365 tenant, if licensed |
Licensing as described on Microsoft Learn, November 2026. Check the client’s own tenant before relying on it, because plans and add-ons change.
The gaps MSPs should check
Microsoft’s tools are good at what they’re built for. The gaps come from how small and mid-sized clients are actually set up.
1. Most small clients don’t have the licences
The typical MSP client runs Microsoft 365 Business Premium. That means Entra ID P1, no P2 and no Defender for Identity. They have Conditional Access, which lets you set sign-in rules, but not risk-based policies that react to a suspicious sign-in on their own.
2. Cloud-only tenants have nothing for Defender for Identity to watch
Defender for Identity’s sensors go on domain controllers and identity servers. A 20-person firm that went cloud-only has none. For that client, the identity protection that matters is on cloud sign-ins, which brings you back to Entra ID P2.
3. One view across clients is not the same as equal detail
Microsoft offers a multitenant view in the Defender portal, and its Learn pages show identities listed across tenants. But each tenant still shows only what its own licences unlock, and Microsoft’s MSSP guide says multitenant management doesn’t support Defender for Business tenants. An MSP with a mix of Business Premium and E5 clients gets uneven detail from tenant to tenant.
4. Google Workspace and other platforms need checking
Some clients run Google Workspace, or both. Microsoft brings some other identity providers in through connectors. Check what is actually covered for each one, and what licence that needs, rather than assuming.
5. Someone still has to respond
Detection is half of ITDR. A risky sign-in at 2 am is only useful if someone, or something, ends the session, resets the sign-in methods and removes the forwarding rule the attacker added. Decide who does that for each client, and when.
A worked example: three clients, three answers
This is an illustrative example, not real clients. An MSP looks after three businesses and wants to know who has ITDR.
- A 15-person design studio, cloud-only, on Business Premium. No domain controllers, so Defender for Identity has nothing to watch. Entra ID P1 only, so no risk-based Conditional Access. Answer: sign-in rules, but nothing scoring risky sign-ins in full.
- A 60-person manufacturer with its own Active Directory synced to Entra ID, on Microsoft 365 E5. Defender for Identity on the domain controllers and Entra ID P2. Answer: well covered by Microsoft, as long as the sensors are installed and someone reads the alerts.
- A 30-person accounting firm on Google Workspace, with Microsoft 365 only for a few licences. Answer: depends on what connectors are set up and what they cover. Most sign-ins happen in Google.
Same MSP, three different answers. That’s the real problem: not whether Microsoft has ITDR, but whether each client has it, and whether anyone is watching it across all of them.
Checklist: does this client have Microsoft ITDR?
- Which Microsoft 365 plan is the client on? Business Premium includes Entra ID P1, not P2.
- Is Entra ID P2 licensed for the users who matter, including admins?
- Are risk-based Conditional Access policies switched on, not just available?
- Does the client have on-premises Active Directory? If yes, is Defender for Identity licensed and are sensors installed on every domain controller?
- Are other identity platforms, such as Google Workspace, covered? How?
- Can you see every client’s identity alerts in one place, with the same level of detail?
- Who responds out of hours, and what are they allowed to do on their own?
How Centeye helps
Centeye Gatewatch watches every sign-in across Microsoft 365 and Google Workspace, without needing Entra ID P2. It catches stolen sessions, impossible travel, password sprays, MFA prompt floods, new admins and dormant accounts waking up, hidden inbox rules and forwarding, and risky app consent. When it finds a takeover, it ends sessions, resets sign-in methods and removes what the attacker added, at the setting you choose. For MSPs, it covers every client tenant from one console. It works alongside Microsoft’s own tools, not instead of them.
Frequently asked questions
Does Microsoft have ITDR?
Yes. Microsoft’s identity threat detection is made up mainly of Microsoft Defender for Identity, for on-premises Active Directory, and Microsoft Entra ID Protection, for cloud sign-ins. Microsoft Learn describes an identity security dashboard in the Defender portal that brings both together.
Is Defender for Identity included in Microsoft 365 Business Premium?
No. Microsoft Learn lists it in Enterprise Mobility + Security E5, Microsoft 365 E5 and E5 Security, or as a standalone licence. Business Premium customers can add it through the Defender Suite add-on.
Does Microsoft 365 Business Premium include Entra ID Protection?
It includes Entra ID P1, not P2. Risk-based Conditional Access and full risk detail need Entra ID P2, per Microsoft’s licensing pages.
Do I need Defender for Identity if I have no on-premises Active Directory?
It’s built around on-premises Active Directory, with sensors on domain controllers and identity servers. A cloud-only business gets most of its identity protection from watching cloud sign-ins instead.
What’s the difference between ITDR and EDR?
EDR watches devices. ITDR watches sign-ins and accounts. An attacker with a stolen session never touches the laptop, so EDR can’t see them. Read ITDR vs EDR, or is Microsoft Defender enough for small business?
New to the terms? See ITDR and account takeover in our glossary.
Defender for Identity sensors and licensing, Entra ID Protection licensing, the identity security dashboard and multitenant management as described on Microsoft Learn, November 2026. Business Premium plan contents from Microsoft’s Business Premium documentation. The worked example is illustrative. Microsoft, Microsoft 365, Entra, Defender and Active Directory are trademarks of the Microsoft group of companies. Google Workspace is a trademark of Google LLC.