CrowdStrike Falcon Identity Protection vs. Microsoft Defender for Identity

Identity Protection is well suited for organizations that need to be monitor AD/Entra for suspicious activity. During a Penetration Test our MDR didn't alert on some odd protocol implementations, but ITDR did. It is also simple to setup for MFA on RDP as well. There are other solutions for it, but found I got more out of ITDR than I did from Duo. ITDR is less suited for smaller organizations since it has a 250-seat minimum. They should lower it to at least 100.

Incentivized

Microsoft Defender for Identity is a great solution for each company that has an Active Directory. It fills in the blanks for Identity related incidents that are being missed in the XDR platform. To get a full view on identity risks it is an essential component

• The MFA component has worked great when it comes to privileged accounts accessing RDP.
• We wanted to stop lateral movement between endpoints and with CrowdStrike Falcon Identity Protection we were able to do that.
• Identity has done a great job at supplementing our MDR service with telemetry.

Incentivized

• detect threats and suspicious activities
• pro-active measurements on possible breaches
• identity security posture

• It's not really a fault of the product, but unless you have Falcon installed on all your endpoints your visibility is limited.
• I've yet to get MFA working on CIFS and Powershell traffic.
• The interface could be streamlined a little. CrowdStrike Falcon Identity Protection keeps changing where things are.

Incentivized

• setup can be complicated, with AD complexity
• Sometimes the load on DCs is pretty high, leading to performance issues
• Better tuning options for preventing false-positive/bening alerts

While the product is solid, I do find there are an excessive number of sections you can navigate to. It takes some time getting used to, but it is a very powerful product. It's not something you'll master right off the bat.

Incentivized

When comparing to Cisco Duo, I felt like the product offered more than just MFA on RDP. When comparing to Silverfort, it came down to pricing. Silverfort was double the cost and I didn't like how Silverfort had separate SKUs. If you wanted MFA on everything the cost increased dramatically.

Incentivized

Microsoft Defender for Identity is more specialized on the Identity platform, it is a single solution compared to a multi-solution. The integration is better when using the XDR suite in combination with Sentinel. Microsoft Defender for Identity gives a better overview of the security posture

• Being able to see right away during a Penetration Test that the product detected anomalies, but our MDR service didn't. It allowed us to go back to the MDR service to show them the results and fix the issue from slipping through the cracks.
• By satisfying the requirements from our insurance provider, our premiums didn't go up (MFA on RDP).

Incentivized

• Cost impact was pretty high
• Learning curve, needed time (money) for training
• Greatly improved detections and gives more insights