On a hybrid municipal estate, security leads worry about pass-the-hash style identity attacks. Which Defender product should they associate with identity threat awareness?
Select an answer to reveal the explanation.
Short Explanation
Pass-the-hash is identity theft with reused credentials — classic directory-side skullduggery. Defender for Identity is the product that watches those identity attack patterns. Bookings SMS, hub navigation, and @mentions are not identity sensors.
Full Explanation
Microsoft Defender for Identity is the Defender product security leads should associate with identity threat awareness for pass-the-hash style attacks on a hybrid municipal estate. Those attacks target identity material and directory pathways that hybrid cities still expose through on-premises domain infrastructure. At fundamentals depth, identity-centric detections map to Defender for Identity rather than to booking SMS features or navigation settings.
Microsoft Bookings SMS confirmations schedule appointments and do not detect pass-the-hash style identity attacks. SharePoint hub site navigation only organizes intranet hubs and is not an identity sensor. Teams channel @mentions notify people in chats; they are not identity attack detectors.
An exam caveat is that Defender for Identity shines in hybrid estates and should be correlated through Defender XDR with endpoint and other signals when investigating lateral movement. Operationally, validate Defender for Identity sensor health for city domain controllers, review identity alerts resembling credential theft or suspicious recon, and update hybrid SOC playbooks to include Defender for Identity investigations. Hybrid SOC tables of organization should list which analysts own identity alerts versus endpoint alerts, while still requiring joint review when both fire in the same window. Pass-the-hash style activity often spans those lanes, so municipal handoffs must be explicit rather than assumed.