Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Microsoft Defender for Identity connects to domain controllers and monitors on-premises Active Directory authentication traffic to spot suspicious activities such as pass-the-hash, brute-force, or lateral-movement attacks. Defender for Endpoint focuses on signals from client and server operating systems, not directly on domain controller traffic. Microsoft Defender for Cloud Apps analyzes SaaS application usage and shadow IT, while Microsoft Sentinel is a separate SIEM/SOAR platform rather than an XDR component. Therefore, only Microsoft Defender for Identity meets the requirement to analyze on-premises AD authentications for credential threats.