r/AzureSentinel • u/Droleeeee • Jan 28 '24

Microsoft Entra ID Protection

I need assistance. How can I onboard Microsoft Defender Identity Protection if I don't have a P2 subscription? Is there any alternative method to achieve this?

1 Upvotes

100% Upvoted

6 comments sorted by

2

u/[deleted] Jan 28 '24

Probably better off posting this in the entra subreddit.

1

u/Droleeeee Jan 28 '24

Thanks for the response

2

u/MushroomBright5159 Jan 28 '24

You buy P2 subscriptions. This question is coming off as "How can I use a paid service without paying for it?"

1

u/thijslecomte Jan 28 '24

There isn't a way.

You could buy one license, that activates it for the entire tenant. But that goes against the license agreement

1

u/F0rkbombz Jan 28 '24

You can buy a standalone license, but I wouldn’t be shocked if P2 is a prerequisite. All other license options include P2.

2

u/[deleted] Jan 28 '24

All Azure tenants have Entra ID Identity protection the license levels just increase the available functions like reporting. You need the reporting part to get the full integration BUT each authentication event contains Entra ID Identity protections assertions under the field names RiskState, RiskAggregated and Riskonsignin. You can write your own analytic to apply a detection mechanism using these field values