Identity threat detection and response (ITDR) is the security category for detecting attacks on identities and identity infrastructure and acting on them. The identities include people and also the service principals, app registrations, OAuth grants and managed identities that sign in without a person. The infrastructure is the directory itself: Microsoft Entra ID, its roles and policies, and the Azure role assignments attached to it. This site always spells the term out, because the acronym alone is shared with unrelated organizations.
Why it matters to a lean team
Endpoint tools watch devices and email tools watch mail. Neither watches what an authenticated account is allowed to do once an attacker holds its token, and in a Microsoft 365 tenant that is where the damage happens: a role assignment, a new client secret, a consent grant, a mailbox rule. A one to five person team rarely has an identity specialist, so detection is whatever the license includes and response is a person in the portal disabling an account. The useful question is which half of the job the current license covers and which half is still manual.
How it shows up in Entra ID and Azure
Detection: Microsoft Entra ID Protection. ID Protection evaluates sign-in risk (the probability that an authentication request is not from the account's owner) and user risk (the probability that the user is compromised), and sorts it into low, medium and high; high means Microsoft is highly confident the account is compromised. Microsoft says its faster detections take 5 to 10 minutes to surface in the reports and offline detections up to 48 hours. PIM does not do this work; its overview covers assignment, activation, approval and audit history and points risk detection to ID Protection as a separate service. The full reports (Risky users, Risky sign-ins, Risk detections) and risk-based Conditional Access require Entra ID P2. Free and P1 tenants see limited information and detections titled "Additional risk detected" with no details. Workload identity risk covers single-tenant, SaaS and multitenant apps but not managed identities, and viewing those reports takes Security Administrator, Security Operator or Security Reader.
Response: Defender XDR automatic attack disruption. Microsoft's built-in response acts at incident level: Defender correlates signals to identify an active human-operated attack, then contains the assets the attacker is using, with a stated confidence bar of 99 percent or higher. Its identity actions include Disable user, Revoke user session, Suspend user in Entra, and protective measures for a compromised OAuth app. It needs E5-tier licensing or a Defender product; plain E3 is not on the list, and Business Premium qualifies through the Defender for Business it includes, whose documentation covers two actions: containing a device and containing a user account at the device level. Configuring it takes Global Administrator or Security Administrator. Anything outside that scope, such as an over-privileged service principal or a role assignment that never became a high-confidence incident, is a manual response.
What to do about it
- Know which detections your license produces. Without Entra ID P2, expect limited risk detail and no risk-based Conditional Access.
- Do not rely on attack disruption for identity-only attacks; it fires on high-confidence human-operated incidents, and in Defender for Business the documented actions are device-level. Write down who responds to a lone risky sign-in on an admin account.
- Decide the response actions before the incident: disable, revoke sessions, remove a role, revoke a consent grant, and in what order. See revoking sessions versus disabling a user.
- Read the identity back from Microsoft after each action instead of trusting the success code. See containment verification.
- Include non-human identities. Managed identities are not in scope for workload identity risk detection, so their credentials and role assignments need a review of your own.
Related terms
- Privileged identity response: the response half of the category, applied to the identities that can change the tenant.
- Identity blast radius: everything an attacker can reach from one compromised identity.
- Attack path: a chain of Entra ID relationships that lets an identity reach a privilege it does not hold directly.
- Non-human identity: any identity that is not a person.
- Illicit consent grant: an attack that trades on OAuth consent rather than a password.
Browse the full glossary, or read the guide on responding to a compromised Entra admin account.
Where Orbitra fits
Orbitra works alongside Microsoft native controls and owns the governed response and evidence layer between detection and directory recovery, at any Microsoft license level. Human and non-human identities sit in one graph with blast radius traversal; more than 70 deterministic detection rules, including streaming detection on Entra sign-in and audit logs, with detections in minutes; responses come from an allowlisted catalog of more than two dozen governed response actions. In Recommend mode, your team executes the response; in Approve mode, a named person signs off before Orbitra executes. Orbitra independently re-reads Microsoft after supported response actions to verify the final state, and every response produces an attributable evidence receipt. Every customer tenant uses Recommend or Approve today. Connect Microsoft in minutes and start read-only.
Sources
- What is Microsoft Entra ID Protection (P2 requirement, Free and P1 reports)
- Risk-based access policies (sign-in risk, user risk, P2)
- What are risk detections ("Additional risk detected")
- Risk detection types and levels (risk levels, latency)
- Securing workload identities with Microsoft Entra ID Protection (scope, roles)
- What is Microsoft Entra Privileged Identity Management (PIM does not detect compromise)
- Automatic attack disruption in Microsoft Defender XDR (scope, confidence, identity actions)
- Configure automatic attack disruption capabilities (licensing, roles)
- Automatic attack disruption in Defender for Business (device-level actions)
- What is Microsoft Defender for Business (included in Business Premium)
- All Microsoft Learn pages checked September 2026.