Book a demo Run a free scan
Free scan

Defender for Identity vs Insight Recon: Do You Need Both?

Detection vs posture · AD Security

Insight Recon vs Microsoft Defender for Identity

Defender for Identity watches your domain controllers for attacks happening right now. Insight Recon finds the misconfigurations those attacks rely on. It weighs each one for your domain and walks you through the fix. If you're already on E5, you'll probably want both.

Run a free scan See a sample report
Updated November 2026 Microsoft docs checked Oct 30, 2026 By the Insight Recon team

If your company is on Microsoft 365 E5, you already own Microsoft Defender for Identity, or MDI. The obvious next question is whether you still need an Active Directory assessment on top of it.

For most teams the answer is yes. MDI is built to catch attacks while they're happening and help you shut them down. Its posture recommendations in Secure Score are useful. They just skip several common AD and AD CS checks that a dedicated assessment covers.

The bottom line

If you have Defender for Identity, keep it. Nothing we sell watches your DCs for attacks or locks an attacker out mid-incident. MDI does both. If you're on E5 or the Defender Suite, it's already paid for.

Add Insight Recon for the posture work. It covers AD and AD CS with 155+ checks. Each finding is rated for what it touches in your domain and comes with the steps to fix it and prove the fix worked. The scan only needs a standard domain user and nothing gets installed on your DCs.

No MDI and no budget for it this year? Start with the free scan. You get one domain and every core AD finding. Just know it won't tell you when someone's exploiting one.

What Defender for Identity does that we don't

  • It catches attacks as they happen. Its alert list runs from DCSync and golden tickets to AS-REP roasting and AD CS abuse.
  • It can act. MDI can disable a user or reset a password mid-incident. Through Defender XDR's automatic attack disruption it can do that on its own while an attack is running. Isolating devices takes Defender for Endpoint.
  • Its posture view stays current. Microsoft says the assessments update in near real time, so there's no scan to schedule.
  • It sees behavior. One assessment flags accounts sending credentials in clear text. Another checks for leaked credentials. A configuration read can't see either one.
  • It covers more than AD. Alerts reach Entra ID, Okta and SailPoint. Its posture recommendations also cover CyberArk Identity.
  • You may already own it. It's part of Microsoft 365 E5, EMS E5 and the Microsoft Defender Suite. If Defender for Endpoint is on your DCs, Microsoft is now turning the sensor on by default for licensed customers. Existing customers get a 30-day banner with an opt-out first.

We don't do any of that. Insight Recon has no sensors and raises no attack alerts. It reads configuration and stops there. If you need to know someone's running DCSync against your domain at 2 a.m., you want MDI.

What Insight Recon actually does

We're pentesters. On our own jobs, the AD tools we ran would hand the client hundreds of findings with no order to them and very little help fixing anything. So we built the tool we wanted on those jobs.

All you run is a portable scanner under a standard domain user. It reads AD, AD CS and Group Policy settings. For most domains the report is in our portal within minutes.

What we check

We curated each of the 155+ checks by hand. Every one covers something an attacker can use or a defender needs to know about. We don't add checks to pad the count. On the certificate side we cover ESC1 through ESC17, apart from ESC12. The hybrid identity checks on paid plans look at what Entra Connect leaves in your AD, without ever touching your Entra tenant.

How we decide severity

Take Kerberos pre-authentication. Turn it off on an account and anyone who knows its name can request a reply from a DC that's partly encrypted with a key made from that account's password. They crack it offline, so there are no failed logons and no lockouts. That's AS-REP roasting.

Defender for Identity

MDI raises an AS-REP roasting alert when someone runs the attack. By then they already have the reply. Secure Score also lists accounts with pre-auth off, as one of eight settings in its “Unsecure account attributes” assessment.

Insight Recon

It's a finding of its own. Before the scanner picks a severity, it checks which accounts are flagged. If they're all disabled, the finding drops to Low because a DC won't authenticate a disabled account. If one is an enabled Domain Admin, the finding goes to Critical.

What to fix first

Quick Wins sits near the top of every report and lists the high-impact fixes that don't take much work. Right after it comes a Top 10 of your riskiest findings.

On paid plans, each account gets a risk score too. It's based on the findings the account is part of, how severe they are and its privilege chain, meaning how it ends up in a group like Domain Admins. The portal shows that chain on the account's page next to its findings, so sorting by risk tells you which accounts to lock down first.

Inside the pre-auth finding

In the sample report, that pre-auth finding is critical and makes the Top 10. The fix is easy, so it also sits in Quick Wins. Open it and you get this:

From the sample report Accounts with Kerberos Pre-Authentication Disabled Critical Easy fix Quick Wins Top 10
  • Affected itemsThe flagged account, with a CSV export.
  • Hacker InsightHow we'd abuse it on a pentest. Ransomware groups often run it soon after they get onto an internal network.
  • Before you startWhat to check first, like a legacy app that needs pre-auth off.
  • The fixPowerShell for one account or a reviewed list, with -WhatIf on the bulk script. Or the same steps in Active Directory Users and Computers.
  • ValidationCheck the flag with Get-ADUser, then try an AS-REP request that should now fail.
  • Exceptions and evidenceWhat to do if an app really needs it off and what to keep for your auditor.

Every Insight Recon finding is built that way.

What's in the report

Secure Score gives you a list of recommended actions to work through. Our report starts with a 0 to 100 score and an executive summary. Below that you'll find Quick Wins, the Top 10 and each finding with its fix, mapped to seven frameworks where they apply.

It also works as a domain inventory:

  • when each account last logged on and set its password
  • privileged group membership
  • computers and domain controllers, stale ones flagged
  • all your GPOs, password policies and local admin GPOs
  • certificate authorities and templates with ESC risk flags
  • your Entra Connect server, version and last sync

All of it is in the sample report, built from a test domain with 92 findings.

Defender for Identity vs Insight Recon, side by side

Category Defender for Identity Insight Recon
Primary job Identity threat detection and response, plus posture recommendations in Secure Score Read-only AD assessment that weighs every finding and walks you through the fix
Attack alerts and response Real-time alerts across AD, AD CS, Entra ID, Okta and more. Can disable users and reset passwords No. It isn't a detection product
AD posture checks Assessments in Secure Score. Microsoft doesn't publish a total 155+ checks across five categories
AD CS (certificate services) ESC1 and ESC6 (both in preview), ESC2, ESC3, ESC4, ESC7, ESC8, ESC11, ESC15. CA-side assessments need a sensor on the CA ESC1 through ESC17, apart from ESC12, read over the network by the scanner
Where you work the list Recommended actions in Secure Score and Exposure Management Severity weighed for your domain. Quick Wins and a Top 10, plus Account Risk Scores and a remediation queue with owners and due dates on paid plans
Fix steps Impacted entities and implementation steps, sometimes with PowerShell Affected objects, prerequisites, PowerShell for one object or in bulk, and GUI steps
Confirming a fix Impacted entities update within minutes. Microsoft's data sets the Completed status Validation steps in every finding. Rescans confirm it, with history on Standard and Enterprise
Compliance mapping None we could find on the assessment pages or in the Secure Score docs NIST CSF 2.0, NIST SP 800-53 Rev 5, CIS Controls v8, MITRE ATT&CK, MITRE Mitigations, DISA STIG and ANSSI where they apply
Report for an auditor Summary, sensitive group change and cleartext password reports. Recommended actions export to CSV. We couldn't find a formatted posture report Full report with a domain inventory and an executive summary export. White-label on Auditor and MSSP
On your domain controllers A sensor on each one, as Microsoft recommends Nothing. A portable scanner runs as a standard domain user
Internet access Required for every sensor. No offline mode documented that we could find HTTPS to our portal, or none at all with the Enterprise offline install
Consultants and MSSPs Licensed inside each client's own tenant Auditor plan at $350 per client assessment, or MSSP for year-round clients

“None we could find” means it wasn't in Microsoft's public docs on October 30, 2026, not that it can't exist in your tenant.

Checks we couldn't find in MDI's posture assessments

MDI covers plenty of the classics, from krbtgt password age and AdminSDHolder to DCSync rights and LAPS. These are the common ones we couldn't find on its category pages.

A few older assessment pages now redirect elsewhere, so a live tenant could still show one of these. If yours does, believe your tenant over us. Half of MDI's certificate assessments and five of its six hybrid ones need their own sensor on the CA or the Entra Connect server.

Check your own domain for these. On the free plan you get every core AD finding for one domain, so the AD CS checks above are covered. Cloud Kerberos Trust is one of the hybrid identity checks, which come with paid plans.

Run a free scan

What runs on your DCs and what leaves your network

Defender for Identity

Microsoft recommends a sensor on every DC. On Windows Server 2019 and later, the v3 sensor turns on through Defender for Endpoint or a separate onboarding script. Activation needs no restart. Older DCs use the v2 installer, which needs 2 cores, 6 GB of RAM and 6 GB of disk on top of the DC's own load. Sensors send DC traffic and Windows security events to Microsoft's cloud. Microsoft keeps that data for 180 days.

Insight Recon

Nothing goes on your DCs. The portable scanner reads over LDAP, SMB, RPC and DNS as a standard domain user. It uploads AD metadata to our portal over HTTPS. It never sends passwords, hashes, Kerberos keys or NTDS.dit. You can delete your data any time.

If nothing can leave your network, MDI won't fit. Microsoft's proxy docs say every sensor needs internet access to its cloud service. We couldn't find an offline mode. Insight Recon Enterprise can run fully offline, with the whole app on a server inside your network. New checks arrive as signed offline files.

On the hosted version, SOC 2 Type 1 is complete and Type 2 is underway. Anyone can get the report under NDA. The rest is in our Trust Center.

When to pick Defender for Identity and when to pick us

We sell one of these, so weigh this with that in mind. It's still what we'd tell a friend who runs AD.

Pick Defender for Identity if...

  • You need to know about attacks while they're happening.
  • You already pay for E5, EMS E5 or the Defender Suite.
  • Your SOC works in Defender XDR or Sentinel and wants identity alerts in the same incidents.
  • You want to disable an account or reset a password mid-incident.
  • You need coverage beyond AD, like Entra ID or Okta.
  • You run in GCC, GCC High or DoD, where MDI is available.

Pick Insight Recon if...

  • You want the checks MDI's assessments skip, like LDAP channel binding and several ESC paths.
  • You want severity that fits your domain and a clear order to fix things in.
  • You want every finding to come with its fix and a validation step.
  • Your auditors want findings mapped to frameworks like NIST CSF 2.0 and CIS Controls v8.
  • You can't put a sensor on your DCs.
  • Nothing can leave your network. Our Enterprise offline install runs entirely inside it.
  • You're a consultant or MSSP assessing client domains.

If you're on E5, run both

MDI lives on your DCs and watches traffic all day. Insight Recon runs as a standard domain user, reads your configuration and is done until the next scan.

If you fix the accounts we flag for AS-REP roasting and Kerberoasting, MDI has less to catch. AD CS works the same way. MDI alerts on ESC1 template abuse and ESC8 relays, while the scan finds the templates and web enrollment endpoints those attacks need.

Tell your SOC before the first scan. A scan reads a lot of AD over LDAP and DNS. MDI has alerts for LDAP, SPN, AD CS and SMB enumeration. If it flags the scan as reconnaissance, you can exclude the scanner's machine in MDI. Microsoft's exclusions page even uses a security scanner as its example.

What Defender for Identity and Insight Recon cost

Microsoft licenses MDI per user across the whole tenant. We charge per enabled AD account a year, or per client assessment on Auditor. Those counts often differ, so treat these as rough guides.

ON E5 OR THE DEFENDER SUITE

MDI is already paid for

Turn it on. Adding Insight Recon costs nothing for one domain. Standard covers every domain you own and adds remediation tracking and new-finding alerts. Your first 1,000 enabled accounts are $10 each a year, with a $3,000 minimum.

10 CLIENT ASSESSMENTS

$3,500

That's our Auditor plan at $350 per client assessment, with 60 days on each domain and white-label reports. MDI is licensed inside each client's own tenant.

Microsoft's prices may vary with your agreement. Our prices are annual list prices.

On Enterprise, each account costs 20% more than on Standard and the minimum is $15,000. The offline install adds a quoted one-time deployment fee that's waived on a 3-year agreement. Our pricing page has the rest.

Defender for Identity FAQ

Is Defender for Identity enough for Active Directory security?

For detection it covers a lot, from DCSync and Kerberoasting to password spray. For posture it covers the common issues but not all of them. On October 30, 2026 we couldn't find assessments for SMB signing, LDAP channel binding or Protected Users on Defender for Identity's assessment pages. We couldn't find seven of the AD CS paths or any compliance mapping either. For the full posture picture, pair it with a dedicated AD assessment like Insight Recon.

Can Insight Recon replace Defender for Identity?

No. Insight Recon is a read-only configuration assessment with no sensors and no event logs, so it can't detect or stop an attack in progress. It finds the misconfigurations those attacks depend on and shows you how to fix each one. It works alongside MDI rather than replacing it.

Will an Insight Recon scan trigger Defender for Identity alerts?

It can. The scan reads a lot of AD in a short time over LDAP and DNS, which MDI's LDAP and SPN enumeration alerts can pick up. Warn your SOC before the first scan. If MDI flags it, you can exclude the scanner's machine.

How much does Defender for Identity cost on its own?

Microsoft doesn't list a standalone price. A reseller lists the US CSP price at $5.50 per user a month, or $66.00 per user a year, on a one-year commitment. MDI also comes in bundles like the Microsoft Defender Suite, a $12.00 per user per month add-on for E3 that's paid yearly.

Run it next to Defender for Identity

Scan one domain for free and see every core AD finding, each rated for your domain and paired with its fix. All it needs is a standard domain user.

Run a free scan Book a demo

You can also open a sample report or check pricing first.

Read-only · standard user · no credit card

Apart from the standalone price, every Defender for Identity fact here comes from Microsoft's own pages. We checked them on October 30, 2026. The date after each one is that page's last update.

Message Center posts were read through the mc.merill.net mirror. If you spot something out of date, let us know and we'll fix it. See every Insight Recon comparison, including PingCastle, Purple Knight and BloodHound.