Identity Defense Current

Customer data storage Registering a Change Auditor Installation Pausing Change Auditor event forwarding Resuming Change Auditor event forwarding Removing a Change Auditor Installation Reviewing the status of your Change Auditor installation

SpecterOps BloodHound Enterprise Integration

Configure a SpecterOps BloodHound Integration

Working with Audit

Using the Audit Dashboard

Working with Activity Indicators Monitoring Audit Health status Identifying critical activity Identifying the top active users Working with My Favorite Searches Monitoring sign-in trends

Searching for specific event data (Quick Search) Working with critical activity Working with searches

Working with private and shared searches Running a search Using built in searches

Active Directory Built in searches Active Directory Federation Services built in searches Active Directory Database built in searches Anomaly Activity built in searches Audit Health built in searches Microsoft Entra built in searches Best Practices built in searches Tier Zero assets built in searches File System built in searches Group Policy built in searches Logon Activity built in searches Microsoft 365 built in searches Identity Defense Audit built in searches Teams built in searches Identity Defense built in searches

Filtering Searches Creating a custom search Copying an existing search Exporting a search Creating a search from an existing search Customizing the search display Viewing search results and event details Copying event details Modifying a search Deleting a search Working with categories

Managing Reports

Enabling and Disabling a Scheduled Report Filtering Scheduled Reports Deleting a Scheduled Report

Working with alerts and notification templates

Using built in alerts and notification templates

Auditing Microsoft Entra

Event collection and Microsoft Entra subscription Working with Microsoft Entra Searches Working with Microsoft Entra events with multiple targets Auditing risk events

Auditing Microsoft 365

Findings

Findings View Findings Object View Investigating Findings

Investigating Tier Zero and Privileged Object Findings Investigating Hygiene and Detected Indicators Investigate Agentic Defense Findings

Using Identity Defense Intelligence with Findings Muting Findings for Hygiene and Detected Indicators Dismissing Findings Viewing Finding History

Tier Zero Objects

How Tier Zero Objects are Identified Tier Zero Objects List Viewing Tier Zero Object Details Adding Tier Zero Objects Manually

Removing Manually-Added Tier Zero Objects

Certifying Tier Zero Objects Protecting Tier Zero Objects Exporting the Tier Zero Objects List

Shields Up Protection (Prevention)

Using Shields Up Enabling Shields Up Disabling Shields Up Override Access for Protected Objects

Privileged Objects

Privileged Objects List Viewing Privileged Object Details Adding Privileged Objects Manually

Removing a Manually-added Privileged Object

Certifying Privileged Objects Exporting the Privileged Objects List

Managing Workload Identities

Entra ID Workload Identities

Identifying Tenants for Workload Identities

Active Directory Workload Identities

Adding and Removing Active Directory Workload Identity Classifying Active Directory Workload Identities Setting Identification Criteria for Active Directory Workload Identities

Viewing Workload Identity Details Setting Workload Identity Category Reloading Workload Identities

Assessments

First Assessment Notification Email Built-in Assessments Using Identity Defense Intelligence with Assessments All Assessments List Creating an Assessment Viewing, Editing, and Deleting an Assessment Viewing Assessment Summary Information Assessing Vulnerability Prevalence Assessment Results

Viewing Details for an Assessed Vulnerability

Discoveries and Vulnerabilities

Discoveries List Pre-Defined Active Directory Discoveries

Additional Permissions Required for Specific Vulnerabilities Discovery for Credential Access Vulnerabilities Discovery for Defense Evasion Vulnerabilities Discovery for Discovery Vulnerabilities Discovery for Initial Access Vulnerabilities Discovery for Lateral Movement Vulnerabilities Discovery for Persistence Vulnerabilities Discovery for Privilege Escalation Vulnerabilities Discovery for Reconnaissance Vulnerabilities

Pre-Defined Entra ID Discoveries

Entra ID Vulnerabilities that Require a Premium License Discovery for Entra ID Credential Access Vulnerabilities Discovery for Entra ID Discovery Vulnerabilities Discovery for Entra ID Initial Access Vulnerabilities Discovery for Entra ID Persistence Vulnerabilities Discovery for Entra ID Privilege Escalation Vulnerabilities

Creating a Discovery Viewing, Editing, and Deleting a Discovery

Hybrid Audit

Overview of the Hybrid Audit Workflow Hybrid Audit Agent Deployment Hybrid Audit Installation Notes Working with Hybrid Audit Brokers

Enabling Hybrid Audit Brokers Viewing Hybrid Audit Broker Details

Working with Audited Events

Creating and Deleting Custom Active Directory Events Excluding Accounts from Events

Working with Protection Templates

Creating Custom User-defined Protection Templates Viewing Protection Template Details Enabling and Disabling Protection Templates Editing Protection Templates Duplicating Protection Templates Deleting Protection Templates

Active Directory Database Auditing and Protection

Agentic Defense

Enabling and disabling Agentic Defense Resolving a high-risk user investigation Troubleshoot Agentic Defense Investigations

Identity Defense Settings

Configuring a Forwarding Destination Managing Indicators

Muting and Unmuting Indicators

Managing Data Collections

Manually Running a Collection Disabling and Re-enabling Data Collection

Configuring Usage Policies

Appendix - Available Audit Search Columns and Filters Appendix - Identity Defense Indicator Details

Indicators by Severity Indicators by Source

Indicators from Audit Indicators from Assessments Indicators from Identity Defense and Protection for Tier Zero Objects

Appendix - Data Collection Details

Active Directory Data Collection Details Microsoft Entra ID Data Collection Details

Appendix - FedRAMP Support Documentation Roadmap

Identity Defense Current - User Guide