Defender for Identity
Microsoft Defender for Identity permit to monitor Azure Active Directory and Active Directory infrastructure. You can easily analyses the data of potential attacks. A Defender for Identity sensor is installed on domain controllers or AD FS servers to access the event logs of these servers. The logs and network traffic will be analyzed by the sensor and then the information needed by Microsoft Defender for Identity will be sent to the Defender for Identity cloud service.