---
title: "Integrate Microsoft Defender for Identity with Red Canary"
slug: "integrate-microsoft-defender-for-identity-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-microsoft-defender-for-identity-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Microsoft Defender for Identity with Zscaler MDR

Zscaler MDR can integrate with Microsoft Defender for Identity. This integration provides visibility into the identity dimension of a confirmed threat and enables you to respond to threats quickly and comprehensively. Zscaler MDR uses a single integration with the Microsoft Graph API to collect alerts from both workloads.

To configure Microsoft Defender for Identity, you need to integrate Microsoft Graph with Zscaler MDR. [Click here for instructions to set up Microsoft Graph](/doc/docs/integrate-microsoft-graph-with-red-canary).

> **Note**: Configuration of the MDE environment is handled by the customer, not Zscaler MDR.

## How are these capabilities activated in Microsoft?

### Defender for Identity

Defender for Identity is a standalone sensor which is deployed on your self-managed Active Directory Domain Controllers. To get started, see Microsoft’s [Prerequisites](https://docs.microsoft.com/en-us/defender-for-identity/prerequisites) and [Installation instructions](https://docs.microsoft.com/en-us/defender-for-identity/install-step1).

### Entra ID Protection

If you have the [appropriate license](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection), get started by [configuring risk policies](https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-risk-policies) in your Azure portal.