Identity Defense Current - User Guide

Introducing Quest Identity Defense Audit
Configuring Audit Working with Audit
Using the Audit Dashboard Searching for specific event data (Quick Search) Working with critical activity Working with searches Managing Reports Working with alerts and notification templates Auditing Microsoft Entra Auditing Microsoft 365
Findings Tier Zero Objects Shields Up Protection (Prevention) Privileged Objects Managing Workload Identities Assessments Hybrid Audit Agentic Defense Identity Defense Settings Appendix - Available Audit Search Columns and Filters Appendix - Identity Defense Indicator Details Appendix - Data Collection Details Appendix - FedRAMP Support Documentation Roadmap

Setting Workload Identity Category

Categories help administrators classify service principals in Entra ID and Active Directory based on compliance, security tiers, or functional roles. This classification improves filtering, reporting, and risk management.

Best Practices

  • Assign categories consistently across similar identities.
  • Use Tier levels to indicate privilege and risk.
  • Regularly review categories for accuracy.

To access category setting:

  1. Navigate to Defend | Identify | Workload Identities.
  2. From the Entra ID or Active Directory tab, select one or more service principals from the list.
  3. Click Set Category in the toolbar.
  4. From the Set Category window, assign up to five labels from a predefined list.
  5. Click Save to apply the changes.

Available Categories

Category Description
Agentic AI AI-related workloads or agents.
FISMA Federal Information Security Management Act compliance.
GDPR General Data Protection Regulation compliance.
GLBA Gramm-Leach-Bliley Act compliance.
HIPAA Health Insurance Portability and Accountability Act compliance.
PCI Payment Card Industry standards.
SAS Statistical Analysis System or similar workloads.
Security Scanning Identities used for vulnerability or compliance scanning.
SOX Sarbanes-Oxley Act compliance.
Tier 0–Tier 4 Security tiers indicating privilege level and criticality.

Reloading Workload Identities

The Reload Identity feature allows administrators to refresh the details of selected service principals from Entra ID without waiting for a full data collection cycle. This ensures that recent changes in are immediately reflected in Identity Defense.

Best Practices

  • Use Reload Identity after making changes to ensure data accuracy.
  • Avoid frequent reloads for large selections to minimize API load.
  • Monitor Last Reloaded timestamps for auditing and troubleshooting.
  • A maximum of 10 workload identities can be selected at once.

To reload workload identity properties:

  1. Navigate to Defend | Identify | Workload Identities.
  2. Select up to 10 service principals from the list.
  3. Click Reload Identity in the toolbar.
  4. Click Reload Now to collect and view latest property values for the selected workload identities.

Assessments

Assessments are a set of Discoveries that are evaluated against collected data to identify vulnerabilities in your organization's Active Directory domains and Entra ID tenants. They run automatically once added, and then run periodically, depending on how often data is collected. This allows you to identify which objects within scope contain vulnerabilities that require further investigation and remediation.

To access Assessments functionality:

From the left navigation menu, choose Defend | Identify | Assessments.

First Assessment Notification Email

If email is configured for Identity Defense, after the first Assessment is completed for the organization, a notification email is sent which includes the total number of the following:

  • Findings without vulnerable objects

  • Findings with vulnerable objects

  • Findings with inconclusive results

  • Findings that returned an error

NOTE: This notification applies only for the first Assessment that is completed for an organization. If email is configured after the first Assessment has run, a notification will not be sent. Subsequent emails will be sent advising that the Assessment has been completed and vulnerable objects have grown in scope.

 

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating