New Defender for Identity alerts is here!

More to you - this gives you more visibility Across your Entra ID and On-Prem Active Directory - and it’s expanding detection across both cloud and on-prem.

Entra ID-focused detections includes:

> Attempt to disable Defender for Identity service principal

> Suspicious account enablement after disruption

> Suspicious OS switch activity

> Suspicious Intune device registration

> Unusual sign-ins (PowerShell, device code flow, user agent/IP anomalies)

On-Prem Active Directory detections includes:

> Suspicious on-prem account enablement

> RBCD (Resource-Based Constrained Delegation) changes and authentication

Read more of What’s new right here: https://learn.microsoft.com/en-us/defender-for-identity/whats-new#new-defender-for-identity-security-alerts?wt.mc\_id=MVP\_353010

Identity remains still the primary attack vector in many organizations, and these alerts focus on post-compromise activity, privilege abuse techniques and evasion and persistence tactics in your environment!

This is a strong step toward better detection of identity-based attacks across hybrid environments.