Entra Admins: Welcome to the Defender Portal

Most Entra admins live in the Entra admin center. The first time you open the Defender portal, it’s overwhelming. You don’t really know where to find anything.

But Microsoft has been pushing a lot of identity security features into the Defender portal lately, and in the workshops with my customers, I keep telling Entra admins that they should definitely look into them. There are a lot of new capabilities you don’t want to miss as an IAM or Entra admin.

To make it easier, I created an overview of them, and I invite you to join me on my journey into identity security in the Defender portal:

Assets: Identities

Probably the easiest entry point into identity security in Defender. It’s an inventory of all the identity objects in your environment. To get the full picture, you need Defender for Identity configured, which means the DFI sensor has to be installed on all your domain controllers, as well as your AD CS, AD FS and Entra Connect servers. Defender for Identity then brings in very rich details about each object. If you click on an identity object, you’ll see the following information about the user:

• Overview / Tags: Besides Sensitive, more and more tags are showing up, like Domain Admin, Privileged Entra PIM Roles, and others.
• Incidents and alerts: A list of open and closed incidents where that user was involved.
• Observed in organization: This is the linked accounts feature, which I wrote about in another blog post: Identity Security in the Defender Portal: What’s New
• Risk score: General risk summary, the account sets (list of accounts) the user has, likelihood of compromise and impact of compromise.
• Timeline: Basically a sign-in log, but with much more information: logins and what the user did in each app (like FileAccessed in SharePoint). Very powerful, but also very confidential! There’s a nice slider on top to jump back to specific days.
• Identity Explorer: A newly introduced graph showing where the user has access to. Needs Sentinel Data Lake.
• Security recommendations: From Exposure Management, but pre-filtered to that user.
• Attack paths: A graph showing what an attacker could do with that account.

The three dots: In the top right of the identity page, next to the tabs. Easily overlooked, but this is where the main actions live: Mark as compromised, Confirm safe, Revoke session, Disable, Enable, Entra ID account settings, View related cases and View in map. Exactly what you need when an identity-based incident comes up.

Another one not to miss: at the top, there are now two different categories, Human Identities and Non-Human Identities. Very helpful to find service accounts that are risky, used by AI agents, highly privileged, overprivileged, unused, external or new:

Exposure Management: Identity Recommendations

I also wrote a post about this one earlier: Defender Recommendations: Identities

It’s a very nice list of recommendations for Active Directory and Entra security tasks — things you could clean up or where you could improve your security posture. Especially helpful for Active Directory, where I see a lot of customers struggling to clean things up or sitting on tons of old objects.

Identities

The “main” identity area in the Defender portal, where the following features are gathered:

• Dashboard: A general overview of your identity posture across all environments, domains, privileged accounts, and so on.
• Coverage & Maturity: Another dashboard, with more focus on optimizing your identity posture in various areas.
• Service Accounts: A list of Active Directory service accounts. Of course you could see them in AD too, but it’s pretty convenient to have them here.
• Password protection: Showing:
  • Hygiene tasks in AD, Entra and even Okta or other IdPs.
  • Password policies from AD and other IdPs.
  • Leaked credentials: Could be very interesting, but I haven’t seen any entries here yet. It will probably be populated in the future if credentials are found on known online sources.
  • Exposed passwords: Here I’ve only seen a single entry so far, where an account had its password in the description attribute! A very bad idea, of course — but very helpful to find it here.

Defender for Cloud Apps: App Governance

So far we’ve focused mainly on identity security. But this newly introduced dashboard shows all your Entra apps in a report you won’t find in Entra itself. Every single customer I’ve shown this to has loved it.

In the Defender portal, navigate to Cloud Apps → App Governance. It shows a dashboard of all apps found, overprivileged apps, unused apps and highly privileged apps.

If you click on Entra ID at the top, you get the full list of all apps found in your tenant. Click on one and you’ll see much more detail, like:

• Summary: Details about the app.
• Graph: Another nice graph showing where that app has access to.
• Permissions: Especially helpful to see the app’s Graph API permissions, including the privilege level.
• Data usage: How much data the app has processed lately.
• Users: A list of users who used the app.
• Sensitivity label: Whether data accessed through the app was labelled sensitive.

Settings: Identities

To be found in Defender under Setup & Configuration → Settings → Identities. Here you’ll find most Defender for Identity settings:

• Deployment On-premises: Shows whether you could install the Defender for Identity sensor on more domain controllers, AD CS, AD FS or Entra Connect servers. Important to check, since you should have it installed on all of them to get the full picture.
• Honeytoken: Another very nice feature that most customers don’t use. You tag a dormant account or device as a honeytoken, and since nobody should ever be using it, any authentication against it triggers an alert. A very cheap trap: create an account with an attractive name, leave it alone, and wait for someone to touch it. Supports users and devices.
• Sensitive: Here you can tag users, devices and groups manually as sensitive. This isn’t only a label — several detections depend on it, like sensitive group modification and lateral movement paths. Defender tags some entities automatically (members of groups like Enterprise Admins, plus high-value servers such as Certificate Authority, DNS, DHCP and Exchange), but everything else that’s critical in your environment you have to tag yourself.
• Exchange server: Works on devices only. Defender detects Exchange servers automatically, so this is mainly for the ones it missed.

Conclusion

If you look at that whole list, there are some pretty impressive and useful features you definitely don’t want to miss as an Entra admin — and probably more coming soon. If you use the Defender portal on a daily basis, you’ll get used to it very quickly, just like you did with the Entra admin center.

Have fun exploring these new identity security features in the Defender portal!

Links

• View the Identity inventory
• Investigate identity password protection
• App Governance in Defender for Cloud Apps