What is ITDR?

An ITDR tool collects identity signals, builds a picture of normal behaviour for each account, and raises an alert when activity departs from it or matches a known attack pattern. Because it looks at what is happening rather than at how things are configured, it is a detection capability, not a settings review.

Examples per platform

• Microsoft 365 and Entra ID: Microsoft Entra ID Protection scores each sign-in and user for risk, with detections such as anonymous IP address use, password spray and leaked credentials. A risk-based Conditional Access policy can then demand MFA or a password reset. Microsoft Defender for Identity adds monitoring of on-premises Active Directory and other identity providers, with detections for reconnaissance, credential compromise and lateral movement.
• Azure: the same Entra signals apply, because Azure sign-ins go through Entra ID.
• AWS: Amazon GuardDuty analyses CloudTrail management events, VPC flow logs and DNS logs, and can flag compromised or exfiltrated AWS credentials.
• Google Cloud: Security Command Center includes threat detection, alongside its checks for misconfigurations and over-permissioned accounts.

The response half

Response means a person or an automation acts on the alert: forcing a password reset, revoking sessions, disabling an account, or pulling the affected identity into an incident. Most of this is judgement, so decide in advance who is allowed to do what.

Microsoft's own documentation for Defender for Identity says that attackers frequently target identities such as users, applications and service accounts to gain access, escalate privileges and maintain persistence. A stolen valid login produces no exploit and no malware, so there may be nothing for a firewall or a configuration check to notice.

The joint NSA and CISA advisory on common misconfigurations (AA23-278a) lists weak or misconfigured multifactor authentication and poor separation of user and administrator privileges among the weaknesses that let intruders in and then spread. Prevention reduces how often that happens, and detection is what limits the damage when it does.

Service accounts and application identities deserve the same attention as people. They often have no MFA, rarely change and are rarely reviewed, and Microsoft lists abnormal behaviour of non-human identities among the activity Defender for Identity watches.

ITDR is easiest to understand next to the terms it is confused with. It answers "is someone misusing an identity right now?"

Term	Main question it answers
ITDR	Is an identity being stolen, abused or used to move through my environment?
CIEM	Which identities hold more permissions than they use?
CSPM	Are the settings of my cloud accounts in line with a standard?
MFA	A preventive control that makes a stolen password less useful on its own.
PAM	How do I control, time-limit and record the use of privileged accounts?

CIEM and CSPM reduce the opportunity, MFA and PAM raise the cost of an attack, and ITDR notices when something gets through. They complement each other and none replaces another.

1. List where identities live: Entra ID, on-premises Active Directory, AWS IAM, Google Cloud IAM and any SaaS identity provider. You can only detect abuse in places you collect signals from.
2. Turn on what your licences already include. Check which risk detections and sign-in logs Entra provides for your plan, and enable GuardDuty or Security Command Center threat detection for your cloud accounts.
3. Make sure sign-in and audit logs are kept long enough to investigate an incident.
4. Decide who receives identity alerts, who may disable an account, and how to reach them out of hours. Keep emergency access accounts out of automatic blocking rules, with their own monitoring.
5. Rehearse one scenario, such as a global administrator whose credentials leak, so the first real response is not the first attempt.

Reducing the attack surface first also helps: fewer inactive accounts, MFA for everyone and tighter permissions give a detection tool less noise to sift through.