Identity threat detection and response (ITDR) is the set of tools and practices that detect and respond to attacks on the identity infrastructure itself: Active Directory, Microsoft Entra ID and other identity providers (IdPs), single sign-on and federation, MFA, service accounts, and the tokens and sessions those systems issue. Gartner introduced the term in March 2022 to describe “the collection of tools and best practices to defend identity systems.” Where EDR watches endpoints, ITDR reads domain controller events, IdP logs and authentication traffic, then responds by revoking sessions, forcing password changes, disabling accounts or demanding step-up MFA.
More security analysis is listed in Enterprise Techie’s topic index.
In this guide
Key facts
| Item | What the sources say |
|---|---|
| Origin of the term | Gartner, 2022 security trends |
| What it defends | Active Directory, Entra ID and other IdPs, SSO, MFA, service accounts |
| Main telemetry | Domain controller and AD FS events, IdP logs, authentication traffic |
| Typical responses | Revoke sessions, reset passwords, disable accounts, require MFA |
| Key guidance | CISA and NSA (2023); ASD-led AD guidance (reviewed September 2026); AA23-320A |
Why identity needs its own detection
CISA and NSA’s Identity and Access Management: Recommended Best Practices for Administrators (March 2023) targets techniques such as “Creating new accounts to maintain persistence” and forging “Kerberos tickets, Security Assertion Markup Language (SAML) assertions, OAuth2.” Abuse of IAM mimics legitimate activity, “which complicates detection of the bad actor.”
Detecting and mitigating Active Directory compromises, from ASD, CISA, NSA and partners (2024, last reviewed September 15, 2026), says control of Active Directory gives “privileged access to all systems and users that Active Directory manages,” often extending to cloud services through Entra ID. Many compromises “exploit legitimate functionality and generate the same events that are generated by normal activity.”
The Scattered Spider advisory (AA23-320A, revised July 29, 2025) describes help desks talked into resetting passwords and transferring MFA, push bombing and, in earlier intrusions, a federated identity provider added to the victim’s SSO tenant. Defenders should watch for “risky logins.”
Identity attack techniques ITDR targets, mapped to MITRE ATT&CK
Detection notes are from MITRE ATT&CK; AD event IDs and recovery steps are from ASD.
| Technique (ATT&CK ID) | Telemetry that reveals it | Typical response |
|---|---|---|
| Kerberoasting (T1558.003) | Bursts of event 4769 on domain controllers for many service accounts, especially RC4 tickets (0x17) | Rotate targeted service account passwords; use gMSAs; strip excess privilege |
| DCSync (T1003.006) | Replication requests from non-DC systems: event 5712 (RPC auditing) or 4662 with replication GUIDs | Full domain compromise: reset all passwords, and KRBTGT twice |
| Golden Ticket (T1558.001) | Event 4769 with no matching 4768; odd ticket lifetime or encryption | Reset KRBTGT twice, letting it replicate between resets |
| Pass the hash (T1550.002) | NTLM network logons without accompanying domain logon events | Force password change or disable; restrict NTLM |
| MFA request generation (T1621) | Repeated push challenges; MFA device and login origin mismatch | Block or reset the account; phishing-resistant MFA |
| Steal web session cookie (T1539) | Tokens reused from unusual user agents or locations without reauthentication | Revoke sessions; secure password reset |
| Forged SAML tokens or Golden SAML (T1606.002) | AD FS key or certificate export (events 70, 1007); cloud sign-ins with no AD FS 1200 or 1202 events | Rotate token-signing and encryption certificates twice in rapid succession |
| MFA modification (T1556.006), trust modification (T1484.002) | New MFA factors, Conditional Access exclusions, new federated IdPs in audit logs | Remove the rogue factor or trust; revoke sessions |
| Valid accounts (T1078) | Impossible travel, risky sign-ins, repeated MFA failures | Disable, force password change, revoke sessions |
How ITDR works: telemetry, posture, detection and response
Telemetry. In Microsoft’s Defender for Identity, “Sensors run on your identity infrastructure,” parsing network traffic and Windows events, while API connectors cover IdPs such as Okta. Microsoft says to install sensors on all domain controllers, including read-only ones, and on AD FS, AD CS and Entra Connect servers.
Posture. Most ITDR products also flag exploitable configuration, such as the unconstrained delegation and disabled Kerberos pre-authentication ASD describes. Microsoft’s posture assessments cover AD, AD CS, Group Policy, hybrid setups and Okta.
Detection. Identity detection leans on baselines and on events that should exist but don’t, such as a Golden Ticket’s missing 4768. ASD also recommends canary objects that deny read access to everyone, so any read attempt generates event 4662 and exposes the enumeration behind Kerberoasting, AS-REP Roasting and DCSync. NIST SP 800-63-4 (July 2025) adds session monitoring, “sometimes called continuous authentication,” which weighs usage patterns, device, geolocation and IP address.
Response. Defender for Identity’s remediation actions include disable, revoke session (Entra ID and Okta only), mark as compromised and force password change (Active Directory and Entra ID). Two cautions: NIST SP 800-63C-4 notes that ending an IdP session “will not necessarily terminate any sessions that subscriber might have at downstream RPs,” and CISA and NSA advise against automatic responses to behavior “that could be important and legitimate.”
ITDR vs EDR, XDR, ISPM, IGA and PAM
| ITDR | EDR | ISPM | IGA and PAM | |
|---|---|---|---|---|
| Question | Is an identity system under attack? | Is this endpoint compromised? | Which identity exposures could an attacker use? | Who should hold which access? |
| Main data | DC and AD FS events, IdP logs | Endpoint activity where the agent runs | Directory and IdP configuration, permissions, MFA coverage | Joiner, mover and leaver events; privileged accounts |
| Typical action | Revoke sessions, reset password, disable account | Isolate device | Fix configuration, remove excess rights | Provision and remove access; just-in-time privilege |
| Timing | During an attack | During an attack | Before an attack | Continuously, by policy |
ITDR vs EDR. OMB memo M-22-01 describes EDR as monitoring and collection of “endpoint data”; see MDR vs EDR. EDR can see a credential dumping tool on a host, but a help desk MFA reset or new federation trust lands in IdP audit logs, which EDR does not collect. The Scattered Spider advisory still calls EDR “particularly useful for detecting lateral connections.”
ITDR vs XDR. ITDR is often an XDR input. Automatic attack disruption in Microsoft Defender XDR uses Defender for Identity to disable users and also revokes sessions. Standalone ITDR feeds a SIEM or another XDR; see SIEM vs XDR.
ITDR vs ISPM. Identity security posture management is preventive. Okta describes scanning “for risks across all human and non-human identities (NHIs),” and CrowdStrike describes fixing misconfigurations across AD, Entra ID and Okta. ITDR catches an attack in progress; many products bundle both.
ITDR vs IGA and PAM. CISA and NSA describe identity governance as centralized orchestration of “user and service accounts management” and recommend PAM with just-in-time access for privileged accounts. Those decide who holds access; ITDR watches how it is used.
Non-human and AI agent identities
ASD notes that Kerberoasting targets accounts “commonly referred to as service accounts,” which “may have administrative privileges,” and that Entra Connect’s MSOL account holds “the same permissions required for DCSync.” Microsoft says workload identities “Can’t perform multifactor authentication.” Entra ID Protection learns a workload identity’s sign-in baseline over 2 to 60 days, and managed identities “aren’t currently in scope.”
AI agents raise the same attribution problem. A NIST NCCoE concept paper (initial public draft, February 5, 2026) proposes to “Link specific AI agent and software systems actions to the identity of the non-human entity.” ITDR can only baseline an agent that has its own identity; see the AI agent identity governance guide.
How vendors package ITDR
Vendors’ own descriptions as of October 2026, alphabetical, not ranked.
| Vendor and product | Coverage and deployment | Response described |
|---|---|---|
| CrowdStrike Falcon Identity Protection | AD, Entra ID and Okta; “one agent” with the Falcon platform | “automatically enforcing MFA or password resets” |
| Microsoft Defender for Identity, with Entra ID Protection | Sensors on DCs and identity servers; API connectors | Disable, revoke session, mark as compromised, force password change |
| Okta Identity Threat Protection with Okta AI | Okta sessions plus partner security signals | Terminate sessions “across all supported apps and devices”; on-demand MFA |
| Semperis Directory Services Protector | Hybrid AD and Entra ID; monitors the AD replication stream | Automatic rollback; password change; disable user |
| SentinelOne Singularity Identity | AD, Entra ID, Okta, Ping and others; deception decoys; shared endpoint agent | Automated containment across identity and endpoint |
| Silverfort ITDR | Inline in authentication flows across hybrid environments | Block, MFA challenge or session termination before authentication completes |
ITDR evaluation checklist
- Coverage: AD including AD FS, AD CS and Entra Connect servers (Tier 0 in ASD’s guidance), Entra ID, Okta and other IdPs.
- Deployment model: domain controller sensors, log and API connectors, replication monitoring or inline enforcement. Check OS limits: Microsoft’s v3.x sensor needs Windows Server 2019 or later with the July 2026 or later cumulative update.
- Real-time vs batch: Entra ID Protection’s real-time detections take 5 to 10 minutes to reach reports; offline detections take up to 48 hours.
- Response and approvals: which actions work on which identity source, who may trigger them, what runs automatically, and whether app sessions are revoked along with IdP sessions.
- Non-human identities: service accounts, gMSAs, sync accounts, workload and managed identities, and AI agents, each named in the proposal.
- Integration: SIEM, SOAR and XDR forwarding, and whether an MDR provider can act through the IdP, as Zscaler MDR does when suspending users “via your IDP.”
- False positive tuning: baselines and trusted locations. Microsoft says its anomalous token detection has “a higher than normal chance” of false positives at low and medium risk, and ASD notes Entra Connect and PAM tools legitimately replicate directory data.
How to decide
- Hybrid estate with on-prem AD: prioritize domain controller and AD FS visibility; Kerberoasting, DCSync, Golden Ticket and Golden SAML all show up in their events.
- Cloud IdP only: start with the IdP’s own threat protection; test session revocation across apps.
- One XDR platform: evaluate its identity module first; compare a specialist where rollback or inline blocking matters.
- No 24×7 SOC: pair ITDR with a managed service holding written authority to disable accounts and revoke sessions; see the Zscaler and Red Canary analysis.
ITDR does not replace recovery planning. ASD warns that evicting determined actors can mean anything “from resetting all users’ passwords to rebuilding Active Directory itself”; plan for it in the ransomware recovery plan.
Frequently asked questions
What is ITDR?
Identity threat detection and response is the category of tools and practices that detects and responds to attacks on identity systems such as Active Directory, Entra ID and Okta. Gartner introduced the term in 2022. Typical responses are revoking sessions, forcing password changes and disabling accounts.
What is the difference between ITDR and EDR?
EDR monitors endpoints where its agent runs. ITDR monitors identity infrastructure: domain controllers, AD FS and IdP logs. EDR can catch a credential theft tool on a laptop; ITDR can catch the stolen credential in use or a rogue MFA registration.
Is ITDR part of XDR?
Often. Microsoft Defender XDR acts on Defender for Identity signals, and CrowdStrike and SentinelOne run identity protection on their endpoint agents. Specialist products send alerts to a SIEM or XDR.
What is the difference between ITDR and ISPM?
ISPM finds exposures before an attack, such as accounts without MFA or excess privilege. ITDR detects and responds to an attack in progress. Many products include both.
Does phishing-resistant MFA make ITDR unnecessary?
No. The Scattered Spider advisory says FIDO/WebAuthn or PKI-based MFA is “not susceptible to push bombing or SIM swap attacks,” but Kerberoasting and DCSync work inside the directory, and ASD notes a Golden SAML can bypass MFA where the relying party trusts the IdP’s MFA claims.
Sources
- CISA and NSA: IAM Recommended Best Practices for Administrators
- ASD and partners: Detecting and mitigating Active Directory compromises
- Joint advisory AA23-320A: Scattered Spider
- NIST SP 800-63-4: 63B, 63C
- NIST NCCoE: AI agent identity concept paper (draft)
- MITRE ATT&CK
- Gartner: 2022 security trends
- Microsoft: Defender for Identity remediation, Entra risk detections, detection types
Last checked: October 2026. Guidance and product features change; check each source before you rely on it.
Buying? Start from RFPhub’s free Non-Human Identity and AI Agent RFP template.