Bitdefender XDR Sensor for MDR (Add-On) Identity

What is included in Bitdefender XDR Sensor for MDR (Add-On) Identity?

Active Directory sensor – Collects domain controller events for attack detection.
Entra ID sensor – Monitors cloud sign-ins, users and app permissions.
Microsoft Intune sensor – Tracks device ownership, policy and app changes.
Identity response actions – Disable an account or force a password reset.
MDR SOC coverage – Bitdefender analysts watch identity telemetry around the clock.
Important – No endpoint protection included; a GravityZone base licence is required.

What are the main benefits of Bitdefender XDR Sensor for MDR (Add-On) Identity?

This is a licence add-on that feeds Active Directory, Microsoft Entra ID and Microsoft Intune telemetry into GravityZone XDR, where it is managed centrally from the GravityZone Control Center and monitored by the Bitdefender MDR Security Operations Centre. Bitdefender lists it as GravityZone XDR Sensor for MDR – Identity, while the console still shows the components as the Active Directory sensor and the Azure AD sensor, the second name dating from before Azure Active Directory was renamed Microsoft Entra ID.

Central console – All identity detections appear in GravityZone Control Center.
Kerberos attack detection – Flags brute force, ticket theft and replay attempts.
Rogue controller detection – Spots attackers registering an unauthorised domain controller.
Cloud sign-in analysis – Detects sign-ins from unusual regions and locations.
Pre-approved actions – SOC analysts can contain accounts without waiting for approval.
Correlated incidents – Identity events joined with endpoint activity in one timeline.

Which company size is Bitdefender XDR Sensor for MDR (Add-On) Identity suitable for?

The deciding factor here is not headcount but whether identity is a real attack surface: a Windows domain, a Microsoft 365 tenant, or both. A company with a handful of Entra ID accounts and no domain controller gains little from a dedicated identity sensor plus a managed SOC on top. From the point where privileged accounts, several locations or an on-premises domain controller exist, identity becomes the realistic route an attacker takes from one compromised laptop to the whole network.

Does Bitdefender XDR Sensor for MDR (Add-On) Identity meet the requirements of Swiss cybersecurity legislation?

The reporting obligation under the revised Information Security Act applies to operators of critical infrastructure in Switzerland, which is a question of sector rather than company size. Affected organisations must report a cyberattack to the Federal Office for Cybersecurity (BACS) within 24 hours of discovery. That deadline is the practical problem this add-on helps with: identity telemetry from Active Directory and Microsoft Entra ID shows which accounts were used, when, and from where, so a first report can name a concrete account and a concrete time window instead of a vague suspicion. Because the sensor feeds the Bitdefender MDR SOC, detection and initial triage do not depend on someone in your own team noticing an alert at two in the morning. What the product does not provide is the reporting process itself: there is no BACS report template, no deadline tracking, and no assessment of whether a given incident is reportable at all. This text is general information and not legal advice; whether your organisation falls under the reporting obligation should be clarified with your own legal counsel.

Does Bitdefender XDR Sensor for MDR (Add-On) Identity meet the requirements of European cybersecurity legislation?

No software product creates NIS 2 compliance, because the directive addresses organisational measures, governance and management accountability rather than tooling. NIS 2 requires entities in scope to have measures covering incident handling, risk analysis, business continuity, supply chain security, access control policies and multi-factor authentication, with management bodies responsible for overseeing them. This add-on contributes concretely to two of those categories: incident handling, through round-the-clock detection and triage of identity attacks by the Bitdefender SOC, and access control, through visibility into privileged group changes, over-permissive application registrations and sign-ins from unusual locations. It contributes nothing to business continuity, backup, supplier assessment or governance documentation, and it does not implement multi-factor authentication, which the directive names explicitly among the required measures. Entities in scope should treat it as one detection control inside a wider management system, not as a NIS 2 measure package.

Does Bitdefender XDR Sensor for MDR (Add-On) Identity help with security questionnaires from large customers?

Yes, for a narrow but frequently asked set of questions. It lets you answer that identity systems are monitored for attacks, that monitoring runs 24/7 through an external SOC rather than during office hours only, that privileged account changes are detected, and that a compromised account can be disabled or forced through a password reset from a central console. It does not answer questions about encryption, patch management, backup and recovery, secure software development, supplier assessment, awareness training or certification status, and a questionnaire that asks for evidence of those will still come back with gaps. The cheaper route to closing them is usually a higher edition or a further sensor add-on inside the same GravityZone family, because the answers then come from one console and one reporting source; mixing vendors creates a second set of evidence you have to reconcile by hand every time a customer asks.

Data loss is expensive: How backups help you avoid outages
Explains why detection alone does not restore data, and how backup planning covers the recovery gap this add-on leaves open.

What is the difference between the Identity Sensor for MDR and the standard XDR Identity Sensor?

The decisive difference is not what the sensor collects, but who looks at what it collects. Both variants gather the same identity telemetry from Active Directory, Microsoft Entra ID and Microsoft Intune, and both surface incidents in the same GravityZone Control Center. The standard XDR Identity Sensor assumes your own team triages those incidents and decides on the response. The MDR variant is intended for companies already enrolled in the Bitdefender MDR service, where the Bitdefender SOC monitors the identity telemetry as part of the managed service and can act through pre-approved actions. Choosing the MDR variant without an active MDR service leaves you paying for managed coverage you cannot use.

Which limitations should you know before buying?

This is a sensor licence, not a protection product: it detects and reports identity attacks but blocks no malware, and it needs an active, compatible GravityZone base licence underneath it. The identity sensor category covers Microsoft identity platforms only, namely Active Directory, Microsoft Entra ID and Microsoft Intune; sensor categories are licensed separately, so buying Identity gives you no network, cloud or productivity application coverage. Response actions against Active Directory require at least one online domain controller running Bitdefender Endpoint Security Tools with the EDR module enabled, which means you must accept an agent on a domain controller. On the cloud side, forcing a password reset requires the registered Entra application to hold the User Administrator role, acting on administrator accounts requires Global Administrator, and the risky-user permissions depend on a Microsoft Entra ID P2 licence, which is a Microsoft cost that catches buyers out most often.

Best antivirus? Why Windows Defender alone is not enough
Sets out where built-in Windows security stops and where dedicated detection and response layers begin.

Frequently asked questions about Bitdefender XDR Sensor for MDR (Add-On) Identity

Does the add-on work without an on-premises Active Directory?

Yes. The Entra ID and Intune sensors use a direct connection between GravityZone and your Microsoft tenant, set up through an app registration with Microsoft Graph permissions, and require no software on your side. Only the Active Directory sensor depends on an agent, since it reads events from the domain controller itself.

Can the Bitdefender SOC disable an account without asking you first?

Only within the pre-approved actions you agree in advance as part of the MDR service. These are defined containment steps, such as isolating a host or neutralising an account, that analysts may execute immediately so that response is not delayed by an approval call at night. Anything outside that agreed list is escalated to your contacts rather than actioned.