Defender for Identity on Anything About IT

Exploring IdentityAccountInfo - Building a KQL Query to Assess Identity Password Security Posture

Sat, 06 Dec 2025 12:27:02 +0000

Recently Microsoft Defender XDR introduced a new table called IdentityAccountInfo, and this one immediately caught my attention. It brings several interesting attributes into Advanced Hunting, including LastPasswordChangeTime and even the sensitivity classification of an identity.

Naturally, my first thought was: this is perfect material for some hunting logic, so let’s build a KQL query out of it.

Why am I excited about this? Because it finally allows us to query identity hygiene data straight from Defender. No external inventory dumps, no AD scripting, just KQL.

Defender for Identity - Automatic Windows Event Auditing Configuration

Sat, 22 Nov 2025 14:29:46 +0000

One of the most common issues we encounter during Defender for Identity assessments is misconfiguration. Many organizations assume that installing the sensor is the final step, but proper post-installation configuration is just as important.

In particular, enabling the required Windows event auditing policies is essential for full detection capabilities. Without these settings, functionality is degraded and health notifications start to appear.

Defender for Identity relies on specific Windows audit categories and subcategories to capture critical events.

Shedding Light on Dormant Sensitive Accounts

Tue, 08 Jul 2025 15:34:54 +0000

Dormant sensitive accounts are a high-risk identity exposure. In Microsoft Defender XDR, the recommendation Remove dormant accounts from sensitive groups helps surface these accounts, including whether they are inactive, disabled, or have expired credentials.

You can export the detected entities, but the export often contains limited context. In many cases, you only get entity names or SID values, which makes remediation harder when you need ownership and organizational details.

A practical approach is to use the SID values to enrich the result set with identity attributes from IdentityInfo. You can quickly build a SID variable list using KustoVars, then query Defender XDR for additional context.