Defender for Identity · Microsoft 365 Security Checkliste

Skillplan M365 Checklist

2026-07-20 19:25

Bewertungsfortschritt 0 / 136 Elemente 0%

Bisherige Erfüllung 0 / 0 Kontrollen 0%

Install Defender for Identity sensors on every Domain Controller and ADFS server.

Use a Group Managed Service Account (gMSA) for the Directory Service account; do not use a standard user.

Enable Honeytoken decoy accounts for early-warning detection of credential probing.

Configure the 'Suspected DCSync attack' alert to page on-call, not only the dashboard.

Allow the Defender for Identity learning period to run at least 30 days before treating alerts as actionable.

Restrict access to the Defender for Identity portal to a dedicated Tier 0 admin group.

Forward Defender for Identity alerts to the SIEM and the SOC ticketing queue.

Review the Lateral Movement Paths report monthly and remediate exposed administrator paths.