ITDR explained

Attackers don't break in any more. They sign in.

Most attacks we respond to start with a stolen password or session, not malware. The attacker signs in to Microsoft 365 like a normal user, and endpoint tools see nothing. ITDR watches that layer. Here is what it catches, how it fits with EDR, and a check of the signals your business would notice today.

Threat data from the Huntress 2026 Cyber Threat Report; Microsoft licensing from Microsoft Learn. Checked 31 October 2026.

Book an identity review Check your signals 07 3114 2808

What it detects
ITDR versus EDR
Eight-signal check

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A security analyst with a headset works at night in front of monitors showing alert dashboards and maps. — **Identity is the target**A valid session looks like work. Detection has to watch behaviour, not files.

The identity threat mix

Four patterns make up most identity attacks.

From the Huntress 2026 Cyber Threat Report. Together they are just over 85% of identity threats it saw.

Access policy violations, 37.2%

Impossible travel, sign-ins that fail policy, reused breached credentials.

Conditional Access
Location rules
Alerting

Identity signal check

Would you know within the hour?

Tick each event your business would notice and act on within an hour, any time of day. The gaps are what ITDR covers.

Tick each event you would notice and act on within an hour, day or night.

A new mailbox forwarding or delete ruleEspecially rules that hide mail about invoices, payments or a client name.
A sign-in from a country you do not work inOr two sign-ins too far apart to be real.
A session token used from a new deviceThe pattern left by phishing kits that proxy the real sign-in page.
A new MFA method added to an accountEspecially just after a risky sign-in.
A user consenting to a new appAn app asking to read mail or files on the user's behalf.
Someone given an admin roleOr a break-glass account used at all.
Many failed sign-ins across accountsPassword spray from one source against many users.
A spike in outbound mail from one mailboxOften phishing sent to your own clients.

Where you stand

0of 8 signals in place

8 gaps to close.

A new mailbox forwarding or delete ruleMailbox manipulation is the second most common identity threat in Huntress's 2026 data.
A sign-in from a country you do not work inThe first visible sign of a stolen password or token.
A session token used from a new deviceThis is how attackers get past MFA without breaking it.
A new MFA method added to an accountAttackers register their own phone or app to keep access.
A user consenting to a new appApp abuse more than doubled year on year in Huntress's data.
Someone given an admin rolePrivilege changes are how a small breach becomes a tenant takeover.
Many failed sign-ins across accountsEarly warning before an account falls.
A spike in outbound mail from one mailboxYour clients usually notice before you do.

Cover the gaps

Two layers

EDR and ITDR watch different things. You need both.

	EDR	ITDR
Watches	Laptops and servers	Sign-ins, mailboxes and app grants
Malware and ransomware running	Yes	No
Stolen session tokens	No	Yes
Malicious mailbox rules	No	Yes
Risky app consents	No	Yes
Admin role changes	No	Yes

Signals

What ITDR looks for.

Suspicious sign-insImpossible travel, anonymising networks, known bad addresses.
Session hijackingA stolen token replayed from a different device or country.
Mailbox rulesRules that hide, forward or delete mail about money.
Rogue appsApps granted access by a phished user, used to keep access.
Outbound phishingA compromised mailbox phishing your clients.
Credential attacksPassword spray and MFA fatigue prompts.
Privilege abuseNew admin roles and any break-glass sign-in.

What you may already have

What Microsoft 365 includes, and what it does not.

Licence	Identity detection	Who responds
Business Basic or Standard	Sign-in logs, audit and security defaults	You
Business Premium	Conditional Access and audit logs; risk-based policies need Entra ID P2	You or your provider
Business Premium + Defender Suite	Entra ID P2 Identity Protection and Defender for Identity	You or your provider
Microsoft 365 E5	Entra ID P2 and Defender for Identity	You or your provider

The tools raise alerts. ITDR is the tools plus someone watching around the clock who can disable the account and clean up within minutes.

When it fires

What a good response does in the first hour.

Disable and revokeBlock the account and revoke every session and token.
Remove what was plantedMailbox rules, new MFA methods, app grants and forwarding.
Check the reachWhat was read, sent or shared, using the audit log.
Reset and restoreNew password, phishing-resistant MFA, user back to work.

Our view

Prevent first, then make sure someone is watching.

Passkeys for admins and finance, Conditional Access, blocked legacy sign-in and admin consent for apps stop a large share of identity attacks before they start. That is the cheapest layer, so we do it first.

What gets through needs a human response at 2 am, not an email alert read at 9. That is the gap ITDR closes for a small business that does not run its own security operations centre.

The order

Getting identity detection in place in five steps.

Step 1Check logging
Audit and sign-in logs on, retained and reachable.
Step 2Harden sign-in
Passkeys for admins, legacy sign-in blocked.
Step 3Lock down apps
Admin consent required, old grants removed.
Step 4Turn on detection
ITDR across sign-ins, mailboxes and apps.
Step 5Agree the response
Who acts, what they can do, and when they call you.

Related guides

Identity security in depth. Stop it, then catch it.

MFA bypass, email fraud, policies and response.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about ITDR.

What is ITDR?

Identity Threat Detection and Response. It watches your identity provider, such as Microsoft Entra ID, plus mailboxes and connected apps, for attacks that use stolen passwords or sessions instead of malware, and responds by disabling the account, revoking sessions and removing what the attacker set up.

How is ITDR different from EDR?

EDR watches laptops and servers for malware and ransomware. ITDR watches sign-ins, mailboxes and app grants. An attacker who signs in with a stolen token never touches your laptop, so EDR sees nothing. You need both.

Do I need ITDR if I already have MFA?

Yes. MFA stops most password attacks, but phishing kits that proxy the real sign-in page can steal the session after MFA is completed. Phishing-resistant MFA such as passkeys reduces that risk; ITDR catches what still gets through.

Does Microsoft 365 include ITDR?

Partly. Entra ID P2 adds Identity Protection risk detection, and Defender for Identity adds identity threat detection. Both come with Microsoft 365 E5 or the Defender Suite for Business Premium. They still need someone watching the alerts and acting on them, 24/7.

What does ITDR detect?

Suspicious and impossible sign-ins, session token replay, malicious mailbox rules, risky app consents, new MFA methods on compromised accounts, admin role changes, password spray, and compromised mailboxes sending phishing.

How long do we have to spot an identity attack?

Often days, sometimes hours. Attackers typically read mail quietly before acting on a payment or sending phishing. Audit (Standard) in Microsoft 365 keeps 180 days of records, which helps the investigation but not the detection. Detection needs someone watching live.

Next step