Email is still the way in, but the part you configure has collapsed into a layered platform Microsoft tunes for you. This is where authority over mail and collaboration actually sits, and what is left to own.
The cloud end has no honeytoken test, so it is proven differently: standing checks that the surface is populated, the telemetry is flowing, and the risk exchange is compounding, run once to certify and again each quarter.
The cloud half of Defender for Identity lights up on licensing, with no workspace, no connection, and no switch. The discipline is not standing it up, it is knowing what is automatic, what you still connect, and how you confirm a surface you never had to build.
The build for standing up the identity sensor estate, both generations, from an empty tenant to a fabric that audits itself and is proven to deliver a detection into the queue.
The cheapest identity attack to survive is the one your configuration never left open. The standing assessments, the honest account of what became of lateral movement paths, and an order that reflects the attacker.
A detection is only half a control. The other half is what you can do the moment it fires, which on this product is two different surfaces people run together at their peril.
You will run two generations of the identity sensor at once, and that is the supported steady state. Which machine belongs to which generation, and why the new one breaks habits carried from the old.
Defender for Identity is no longer the on-premises member of the suite. It has two ends now, a sensor fleet on the identity fabric and the cloud directory itself, and the licensing carries a question nobody has answered.
