Microsoft Defender for Identity vs Semperis for ITDR
SHORT ANSWER
Editorial assessment · Desk research from public vendor material · Reviewed 2026-09-29
Scores by criterion
Monitors on-premises Active Directory, Entra ID and other identity providers such as Okta, with sensors on identity infrastructure.
Scans for hundreds of indicators of exposure and compromise across Active Directory and Entra ID, using the AD replication stream.
Higher score: Microsoft Defender for Identity
Positioned for detection, investigation and response; inline blocking at authentication is not described on the overview page.
Automatic rollback of malicious changes, rather than blocking sign-in attempts.
Higher score: Tie
Covers compromised credentials and lateral movement stages; token forging is not singled out on the overview page.
Token and session attacks are not addressed on the pages reviewed.
Source: Semperis Directory Services Protector · Semperis products
Higher score: Microsoft Defender for Identity
Correlates identity alerts into incidents in the Microsoft Defender portal with remediation actions.
Rolls back malicious changes in AD and Entra ID and sells forest recovery and Okta tenant recovery.
Source: Semperis Directory Services Protector · Semperis products
Higher score: Semperis
Posture assessments through Microsoft Secure Score and lateral movement path analysis.
Free Purple Knight assessment with 218+ indicators across AD, Entra ID and Okta; Forest Druid for Tier 0 attack paths.
Source: Semperis Purple Knight · Semperis products
Higher score: Semperis
Long-running Microsoft product; licensing is not stated on the overview page.
Free assessment tools; product pricing is not published.
Source: Semperis Purple Knight
Higher score: Tie
Weighted total
Microsoft Defender for Identity 7.0 / 10 · Semperis 6.8 / 10
Higher score: Microsoft Defender for Identity
Where each one scores higher
Microsoft Defender for Identity scores higher on
- detection breadth (9 vs 8)
- token and session attacks (6 vs 4)
Semperis scores higher on
- response and recovery (7 vs 9)
- posture and attack paths (8 vs 9)
Pricing, side by side
Microsoft Defender for Identity
Licensing is not stated on the overview page.
Source: Microsoft Learn: Defender for Identity
As published on 2026-09-29.
Semperis
Purple Knight assessment is free. Product pricing not published, contact sales.
Source: Semperis Purple Knight
As published on 2026-09-29.
Which should you choose?
Choose Microsoft Defender for Identity if detection breadth and posture and attack paths matter most. It scores 9 and 8 on them. Monitors on-premises Active Directory, Entra ID and other identity providers such as Okta, with sensors on identity infrastructure.
Choose Semperis if response and recovery and posture and attack paths matter most. It scores 9 and 9 on them. Rolls back malicious changes in AD and Entra ID and sells forest recovery and Okta tenant recovery.
Questions
Which scores higher overall, Microsoft Defender for Identity or Semperis?
On our weights for ITDR, Microsoft Defender for Identity scores 7.0 / 10 and Semperis 6.8 / 10. Totals are the weighted average of six criterion scores; the weights are listed on the ITDR page.
Where does Microsoft Defender for Identity score higher than Semperis?
On detection breadth; and token and session attacks.
Where does Semperis score higher than Microsoft Defender for Identity?
On response and recovery; and posture and attack paths.
Related
Sources
- Microsoft Learn: Defender for Identity: https://learn.microsoft.com/en-us/defender-for-identity/what-is
- Semperis Directory Services Protector: https://www.semperis.com/active-directory-security/
- Semperis products: https://www.semperis.com/
- Semperis Purple Knight: https://www.semperis.com/purple-knight/