Microsoft Defender for Identity Annual Subscription (12 Months)
PRODUCT DESCRIPTION
Microsoft Defender for Identity Annual Subscription (CFQ7TTC0LH0D:0001) - Local Support
Identity Attack Detection Across On-Premises, Cloud and Hybrid
Microsoft: "Microsoft Defender for Identity helps organizations detect, investigate, and respond to identity-based attacks across on-premises, cloud, and hybrid environments." It is the product that watches Active Directory itself — the domain controllers, the federation servers, the certificate services and the sync servers — rather than the endpoints or the mailboxes. If your identity estate is still anchored on-premises, this is the piece of the Defender family that covers it.
What It Watches For
Microsoft lists proactive identity security posture assessments surfaced through Microsoft Secure Score, identification of risky configurations and exposures, and lateral movement path analysis on the posture side. On the detection side it monitors authentication and authorisation behaviour, credential abuse and risky sign-ins, privilege escalation and suspicious role or group membership changes, lateral movement attempts, and "abnormal behavior related to service accounts and non-human identities".
It Is Enabled Tenant-Wide, Which Changes How You Count Licences
This is the most important commercial fact on the page and it catches buyers out. Microsoft states: "Microsoft Defender for Identity features are enabled at the tenant level for all users within the tenant. Some tenant services, such as Microsoft Defender for Identity, aren't currently capable of limiting benefits to specific users." You cannot switch it on for one department. Size the purchase against the whole tenant and ask us to confirm the position in writing before you commit.
Sensors Go on Your Servers, Not Your Endpoints
Deployment is server-side. Microsoft supports the sensor on Windows Server 2016 — which "Requires KB4487044 or a newer cumulative update" — 2019, 2022 and 2025, with both desktop experience and server core supported and Nano server not supported. Sensor placement is documented as "domain controllers, AD FS, AD CS, and Entra Connect servers". Map those servers before you buy so the deployment plan is realistic.
Defender for Identity Annual Subscription Datasheet — Licensing and Specifications
Licensing
| Licensed by | Per user, as a standalone per-user subscription licence |
| Scope of activation | Tenant-wide. Microsoft: features "are enabled at the tenant level for all users within the tenant" and the service is not "capable of limiting benefits to specific users" |
| Included in | Enterprise Mobility + Security E5 and A5; Microsoft 365 E5, A5 and G5; the Microsoft Defender Suite and its EDU, GOV and FLW variants; Microsoft Defender + Purview Suite FLW; and Microsoft Defender for Identity for Users |
| A second eligibility list | Microsoft's prerequisites page words the eligible list slightly differently: EMS E5 or A5; Microsoft 365 E5, A5 or G5; Microsoft 365 E5, A5, G5 or F5 Security; or Microsoft 365 F5 Security + Compliance, with the footnote that both F5 licences require Microsoft 365 F1 or F3, or Office 365 F3, plus Enterprise Mobility + Security E3 |
| Minimum purchase | Not published by Microsoft |
| Term | Twelve months as sold by SourceIT |
Sensor Requirements
| Sensor operating systems | Windows Server 2016 ("Requires KB4487044 or a newer cumulative update"), 2019, 2022 and 2025 |
| Server installation type | "Both servers with desktop experience and server cores are supported. Nano servers aren't supported" |
| Where sensors go | "Installations are supported for domain controllers, AD FS, AD CS, and Entra Connect servers" |
| Tenant requirement | "To create your Defender for Identity workspace, you need a Microsoft Entra ID tenant" |
| Administrative role | "You must have a user with a Security administrator role" |
Data Residency and Retention
| Published data centre locations | "Asia (Southeast Asia); Australia (Australia East, Australia Southeast); Europe (West Europe, North Europe); India (Central India, South India); North America (East US, West US, West US2); Switzerland (Switzerland North, Switzerland West); United Arab Emirates (UAE North and UAE Central); United Kingdom (UK South)" |
| What that means for a Singapore tenant | Southeast Asia is on Microsoft's list, which makes this the best-placed of the Defender family for Asia-Pacific. Note that Microsoft's wording is "Asia (Southeast Asia)" and does not name Singapore, so this page does not claim that data stays in Singapore |
| How placement is decided | "Your workspace is automatically created in the data center that's geographically closest to your Microsoft Entra ID. Once created, Defender for Identity workspaces can't be moved to another data center" |
| Retention | "Microsoft Defender for Identity retains data for 180 days" |
What Microsoft Does Not Publish for This Product
The following are commonly asked about but are not stated on any current official Microsoft source for this product, so SourceIT does not quote them: a minimum seat count, an explicit Singapore data residency commitment, any way to license only a subset of tenant users and a mapping between the commerce SKU identifier and this product. We would rather leave a field blank than print a figure we cannot substantiate.
Lifecycle, End of Support and Entitlement
SourceIT sells this as a twelve-month subscription with a GST invoice in Singapore. The subscription is a right to use the service for the term, not a perpetual licence: when the term ends the entitlement ends unless it is renewed.
Microsoft publishes no dedicated lifecycle page for Defender for Identity and no retirement date. The former name is confirmed by Microsoft's own announcement: "Microsoft Defender for Identity (previously Azure Advanced Threat Protection)". Customers still search for Azure ATP, and the documentation routing still recognises it.
Talk to our team before the renewal date rather than after it. Seat counts, mid-term changes and co-terming with the rest of your Microsoft estate are all easier to arrange in advance, and we can quote the alternatives if a bundle would work out better for you.
Support and Entitlement Position
This is a software subscription, not hardware. It carries no hardware warranty, and any warranty term you see on a hardware listing does not apply here. What you are buying is a twelve-month right to use the service, together with SourceIT's local support in Singapore. Microsoft's own condition is that technical and billing support for a subscription bought through a partner runs through that partner, so for this subscription that means us: raise the ticket with SourceIT and we escalate to Microsoft where it needs to go. Renewal, seat changes and co-terming are handled on your SourceIT account. Ask our team for the current entitlement position in writing with your quotation.
Compatibility, Deployment and System Requirements
Check what you already own before you buy this. Several Microsoft 365 and Enterprise Mobility + Security bundles already include this service, and a tenant that buys it separately can end up paying twice for the same entitlement. Send us your current subscription list and we will check your existing entitlements before we quote.
The deployment shape is different from the rest of the Defender family: sensors are installed on servers rather than on user endpoints. Microsoft supports the sensor on Windows Server 2016 with KB4487044 or a newer cumulative update, and on Windows Server 2019, 2022 and 2025, on both desktop experience and server core installations. Nano server is not supported. Sensors are placed on domain controllers and on AD FS, AD CS and Entra Connect servers.
You will need a Microsoft Entra ID tenant to create the workspace, and a user holding the Security Administrator role to do it. Workspace placement is automatic and permanent: Microsoft creates it in the data centre geographically closest to your Entra ID and states that workspaces "can't be moved to another data center".
Because activation is tenant-wide, the sizing conversation is about your whole user population rather than a pilot group. Send us your tenant user count and we will size it properly rather than quote a number that will not stand up at renewal.
Deployment Requirements
| Sensor operating systems | Windows Server 2016 with KB4487044 or newer, 2019, 2022, 2025. Desktop experience and server core; not Nano server |
| Sensor placement | Domain controllers, AD FS, AD CS and Entra Connect servers |
| Tenant | A Microsoft Entra ID tenant is required |
| Administrative role | Security Administrator |
| Activation scope | Tenant-wide; cannot be limited to specific users |
Official Microsoft Sources & Downloads
- What is Microsoft Defender for Identity (Microsoft Learn)
- Defender for Identity prerequisites (Microsoft Learn)
- Defender for Identity privacy and data security (Microsoft Learn)
- Defender for Identity technical FAQ (Microsoft Learn)
- Microsoft Defender service description (Microsoft Learn)
- Microsoft security product renaming announcement, 22 September 2020
- Modern Lifecycle Policy (Microsoft Learn)
Where a figure appears on this page it is quoted from one of these Microsoft pages; where Microsoft publishes nothing, this page says so rather than filling the gap. Supplied by SourceIT in Singapore with a GST invoice and local support. For a written quotation, current stock position or delivery lead time, contact our team.
Frequently Asked Questions — Defender for Identity Annual Subscription
Can we license this for just our IT team or one department?
No. Microsoft states that Defender for Identity features "are enabled at the tenant level for all users within the tenant" and that the service is not "capable of limiting benefits to specific users". That means the licence count is driven by your tenant, not by a pilot group. It is the single most common under-buy on this product, so let us size it with you.
Where does our data go?
Microsoft publishes a data centre list for this product that includes "Asia (Southeast Asia)", which makes it the best-placed member of the Defender family for an Asia-Pacific tenant. Two caveats: Microsoft's wording names the Azure region, not Singapore, so we do not claim your data stays in Singapore; and placement is automatic and irreversible — the workspace is created in the data centre closest to your Entra ID and "can't be moved to another data center".
What has to be installed, and where?
Sensors, on servers. Microsoft supports Windows Server 2016 with KB4487044 or a newer cumulative update, and Windows Server 2019, 2022 and 2025, on both desktop experience and server core; Nano server is not supported. Sensors go on domain controllers and on AD FS, AD CS and Entra Connect servers. Map those servers before you order and we will sanity-check the plan with you.
Is this the product that used to be called Azure ATP?
Yes. Microsoft's own announcement reads "Microsoft Defender for Identity (previously Azure Advanced Threat Protection)". If you have existing documentation, runbooks or a licence schedule referring to Azure ATP or Azure Advanced Threat Protection, this is the same service under its current name.
We have Microsoft 365 E5. Do we already have it?
Yes. Microsoft lists Defender for Identity as included in Microsoft 365 E5, A5 and G5 and in Enterprise Mobility + Security E5 and A5, as well as in the Defender Suite. Note that Microsoft's prerequisites page words the eligible list slightly differently from its service description; if your plan sits near the edge of either list, ask us to confirm in writing before you buy.
