Managed ITDR: identity threat detection and response, managed

Why identities need watching

A stolen password or session token gives an attacker access that looks legitimate. With one compromised Microsoft 365 account they can read mail, set up forwarding rules, send convincing payment requests to your customers and reach files in SharePoint and OneDrive, often without touching a laptop or triggering endpoint protection. Multi-factor authentication makes this harder, but phishing kits that relay sign-ins and steal session tokens can get around it.

Identity threat detection and response (ITDR) watches identity systems for the signs of that misuse. Our sister site explains the technology and the wider topic of identity security. This page is about running it as a managed service: who watches the alerts, what they are allowed to do, and how Forever Systems fits in.

What managed ITDR detects

Exact detections differ by vendor, but managed ITDR services typically look for:

• Impossible travel and sign-ins from countries you have not approved
• Session hijacking, where a stolen session token is reused from another device
• Business email compromise behaviour: new inbox rules, forwarding to outside addresses and permission changes
• Credential abuse and privilege escalation, such as an account suddenly gaining admin rights
• Directory weaknesses in Active Directory and Entra ID that make attacks easier
• Leaked credentials linked to your organisation, on services that include dark web checks

The response side is what makes it managed. When analysts confirm a compromise, they can contain it at any hour rather than waiting for your IT team to wake up, within the authority you set.

Managed ITDR services we supply

Blackpoint, Sophos (with Sophos MDR), Check Point and ThreatDown (with ThreatDown MDR) put the vendor's own 24/7 analysts behind identity detections. WatchGuard CloudDR and Cisco Identity Intelligence are detection and posture tools rather than SOC services: we set them up and tune them with you, and they can sit alongside an MDR service. Either way, Forever Systems recommends the right option, connects it and acts as your escalation point.

CrowdStrike's Falcon Identity Threat Protection Complete puts CrowdStrike's Falcon Complete team on identity threats in Active Directory and cloud identity providers, and SentinelOne's Wayfinder MDR covers identity alongside endpoints; see our vendors page. Each vendor's own documentation sets out the current list of supported sources, and we check yours are covered before you buy.

Blackpoint ITDR in more detail

Blackpoint ITDR is a good example of how a managed identity service works. Blackpoint's 24/7 SOC watches Microsoft 365 and Cisco Duo for impossible travel, sign-ins through VPNs and proxies, activity outside a user's normal pattern, business email compromise behaviour and session hijacking.

When its detection model is confident, it contains Microsoft 365 credential threats automatically: suspending the account, terminating active sessions and forcing a password reset, then producing an incident summary. Anything below the confidence threshold goes to a human analyst. Blackpoint ITDR works on standard Microsoft 365 plans, and gains extra detection signals where users hold Entra ID P2 or Microsoft 365 E5. It is available on its own in CompassOne Essentials ITDR or alongside endpoint MDR in the Core and Standard packages; see Blackpoint ITDR licensing.

What Forever Systems does

Identity services touch the accounts your staff rely on every day, so setup and agreement up front matter more than anywhere else.

1. Connect: an administrator authorises the service in your Microsoft 365, Okta or Duo tenant; we guide that and confirm data is flowing.
2. Tune locations and baselines: we set approved countries and known travel patterns so alerts reflect how your team really works.
3. Agree response authority: which actions run automatically, such as session revocation, and which need a person to approve.
4. Escalation: we agree contacts with you and act as your escalation point when the vendor contains an account.
5. Clean up: after an incident we can help remove attacker inbox rules and app consents, reset credentials and check whether customers or suppliers were contacted.

Hybrid environments need care: an account disabled in Entra ID can be re-enabled by the next directory sync from on-premises Active Directory, so both sides need attention. Responsibilities are written down and confirmed at quote.

Who managed ITDR suits

Managed identity protection is worth a close look if any of these apply:

• Your work lives in Microsoft 365: email, files and Teams are where your data and your customer conversations are
• You handle payments or client money: one compromised mailbox can be used to divert an invoice payment
• Staff work remotely or travel: sign-ins come from many places, so you need someone to tell a real login from a stolen one
• Your directory has history: old admin accounts, service accounts nobody owns and inconsistent MFA are common in hybrid Active Directory and Entra ID estates
• An insurer or customer has asked how you detect account takeover

For many smaller organisations, a managed ITDR service is a lighter first step than full endpoint MDR, because there is nothing to install on devices. See managed security for small business for other right-sized options, and managed email security services for stopping the phishing that leads to account takeover.

Managed ITDR alongside MDR

Identity attacks rarely stay in one place. A phished account leads to a malicious file on a laptop; a compromised laptop leaks a session token. That is why most vendors integrate ITDR with their MDR service, so the same analysts see both halves.

If you already run Microsoft Defender, see MDR for Microsoft Defender; for a service watching identity, email, endpoint and network together, see managed XDR. Strong MFA reduces how often ITDR has to act; Cisco Duo is one option we supply. Pricing is usually per user or identity, so ask us for a quote and contact us.