Managed identity threat detection and response (ITDR): what MSPs and security teams need

For MSP service owners and technicians, managed identity threat detection and response comes down to a practical service question: who investigates a compromised client account, and who can contain it after hours? Consistent handling across client environments depends on clear ownership from prevention through recovery.

Start by checking the identity coverage already included in your managed detection and response (MDR) service or extended detection and response (XDR) deployment. This guide is written primarily for MSPs, but internal security teams can use the same ownership and handoff checks.

Key takeawaysIdentity monitoring complements endpoint and network defenses. Managed ITDR adds investigation and response ownership. Assess four connected responsibilities: reduce exposure, detect and investigate, contain, recover. Existing MDR or XDR may already meet part of the requirement.

Quick definitionIdentity threat detection and response (ITDR) is a security discipline for detecting and responding to attacks against accounts, credentials and identity systems. It examines authentication and account activity for signs of misuse, then supports investigation and containment. ITDR complements identity and access management, multifactor authentication (MFA) and access policies rather than replacing preventive controls that determine who should receive access.

Here, identity coverage means the identities and activity being monitored, the response actions the service supports and the team responsible for acting.

Identity risk does not end when a login succeeds. Verizon's 2026 Data Breach Investigations Report executive summary identifies credential abuse as the initial access method in 13% of analyzed breaches, compared with 31% for vulnerability exploitation. The analysis covers known initial access vectors and excludes Error and Misuse.

Those figures cover initial access, not the full intrusion. They support maintaining identity defenses alongside vulnerability management, endpoint security and network controls rather than treating identity as the only attack surface.

For MSPs investigating identity-based attacks, the practical test is what happens after a successful login. Suspicious mailbox rules or unexpected application access may require identity and application evidence alongside endpoint context. Keep weak access settings separate from account misuse: the former call for posture correction, while the latter require investigation.

Managed ITDR places operational responsibility for identity detection and response with a service provider. This guide focuses on services that combine identity monitoring with a staffed security operations center (SOC) for 24/7 investigation and agreed containment. Coverage hours and response authority should be explicit in the contract.

Automation can carry out approved actions, but someone still has to validate the compromise, confirm that containment worked and investigate any remaining access. Managed identity security therefore needs a clear handoff among the SOC, MSP and client.

Assess four connected responsibilities. Reduce exposure through access controls and configuration hygiene. Detect and investigate suspicious identity activity. Contain unauthorized use. Recover damaged or deleted identity objects and settings, then restore access safely. Managed ITDR mainly addresses detection and response; posture management and backup may remain with other services or teams.

Containment limits an incident's spread, while recovery restores affected assets and operations. Neither suspending an account nor completing a restore proves that attacker persistence is gone. Define who investigates remaining access and who authorizes a return to normal operations.

Effective managed ITDR should connect identity evidence to response across every environment in scope.

Identity telemetry: Coverage should spell out which directory, identity-provider and application events are collected for human accounts, service accounts and application identities. A connector alone does not establish coverage of every identity type.

Authentication analysis: Password spraying, unusual sign-ins and changes in account behavior all warrant investigation. Impossible travel is a lead, not a verdict; legitimate travel and network changes also need to be considered.

Session and token misuse: Visibility must extend beyond failed logins. A stolen authenticated session can provide access without another MFA prompt, which makes post-authentication investigation essential.

Privilege abuse and lateral movement: Unexpected privilege changes and movement with compromised credentials need scrutiny. Privileged accounts should be covered explicitly rather than assumed to receive equivalent monitoring.

Executable containment: Responders need supported account-containment actions and evidence that those actions succeeded. Examples include suspending accounts or revoking sessions. Detection of compromised credentials also needs a defined path to containment and investigation of remaining access.

A break in logging is not evidence of a quiet environment. Assign an owner to restore interrupted feeds.

ITDR is an identity-security focus, MDR is a managed operating model and XDR provides cross-domain detection and response. A managed service can operate XDR technology and include identity-specific detections.

For ITDR versus MDR, compare service scope. For ITDR versus XDR, compare detection depth and integrations. Add managed ITDR only when it closes a demonstrated gap.

Put each option through the same identity scenarios, including an account takeover that produces no malware alert on a managed endpoint.

Microsoft 365 investigations need to connect authentication with activity inside the account. In business email compromise (BEC), suspicious inbox and forwarding rules can matter as much as the sign-in that came first. Successful authentication alone does not establish legitimate use.

Session theft and MFA fatigue call for different checks. Adversary-in-the-middle phishing can capture authenticated sessions, while repeated MFA prompts can pressure a user into approving access. Do not assume every token type or MFA deployment has the same exposure.

OAuth application authorization deserves separate attention. Malicious consent grants can expose data through permissions given to an application. In the ConsentFix campaign documented by Push Security, users were tricked into sharing a URL containing an authorization code, which attackers then redeemed for tokens. That is different from authorizing a malicious third-party application.

Microsoft Entra ID Protection supplies user-risk and sign-in-risk signals to Conditional Access. Risk-based policies require Microsoft Entra ID P2 and can trigger access restrictions or risk remediation. Managed ITDR should complement these native capabilities, with telemetry and permissions assessed for each client's Microsoft 365 environment.

Run a demonstration that combines an unusual sign-in, a forwarding rule and unexpected application access. Ask analysts to connect the events, preserve the timeline and identify who owns the business email compromise investigation.

Judge ITDR services by how they handle responsibility and detection, not by the length of the integration list.

Who can act after hours? The agreement should define approval thresholds, escalation contacts and what happens when nobody answers. Service commitments should distinguish between alert delivery, analyst acknowledgment and completed containment.

Will containment survive directory synchronization? In a hybrid environment, the authoritative directory can reverse a cloud-only disablement. A demonstration should cover both directories and show how a failed containment action is escalated.

Can the service operate across client environments? Account coverage, permissions and licensing prerequisites should be explicit. Even with centralized monitoring, each client needs its own approval policy, escalation contacts and access to evidence.

Before rollout, document the identities, telemetry and incident scenarios in scope, along with response authority and restoration ownership. Include required permissions and access to evidence. Then determine whether the gap is technology, operational ownership or both.

Internal security teams should name the SOC, identity-administration and backup owners involved. Test their after-hours handoffs and specify who can approve access restrictions, restore identity data and authorize normal access.

Acronis Protected 365 provides complete, natively integrated, 7-in-1 protection for Microsoft 365 and is designed for MSPs. Its single multitenant platform helps reduce vendor sprawl and operational complexity across client environments. Backup and recovery, posture management and XDR address different stages of identity resilience. MDR adds managed operations through Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud). Together, these capabilities do not constitute a stand-alone managed ITDR product.

Recover identity data. Entra ID backup and recovery supports restoration of backed-up identity objects and settings where the capability is available and configured. The Entra ID recovery walkthrough shows a deleted user being restored and the result verified. Recovery does not replace investigation or containment.

Reduce exposure. Acronis Security Posture Management for Microsoft 365, available through Cyber Platform (formerly Acronis Cyber Protect Cloud), supports reusable baselines, monitoring for configuration drift and manual or automatic remediation across client environments. A posture finding is not proof of compromise.

Detect and investigate. Acronis XDR, available through Cyber Platform (formerly Acronis Cyber Protect Cloud), combines identity information with endpoint, email and Microsoft 365 evidence. Its Microsoft Entra ID integration adds affected signed-in-user details to supported incidents, particularly when a threat is detected on an endpoint. This is incident enrichment, not evidence of comprehensive identity-only detection.

Add managed operations. Acronis MDR provides 24/7 monitoring and investigation for supported endpoint detection and response (EDR) and XDR incidents received through Cyber Platform (formerly Acronis Cyber Protect Cloud). The response provided depends on the selected service scope.

Acronis fit and prerequisitesFit: MSPs and internal teams coordinating Microsoft 365 posture, identity-aware investigations, recovery and managed security operations.Check before rollout: Enabled services and integrations, permissions, entitlement, response authorization and supported recovery objects. Availability and responsibilities depend on the deployment.

Internal security teams working with an MSP should agree which investigations and recovery tasks the provider will handle and which access-restoration decisions remain with the organization's own administrators.

No. Identity and access management governs access. ITDR detects and responds to identity abuse. It does not replace account provisioning, access reviews or least-privilege controls.

No. Keep MFA and Conditional Access. ITDR adds investigation and response for misuse that preventive controls do not stop, including suspicious authenticated sessions.

Not necessarily. Some MDR services include identity monitoring and response. Compare supported identities, detections and containment actions with your requirements before adding a separate service.

The provider should demonstrate containment across the relevant cloud and on-premises directories. Check that synchronization does not reverse the response and that failed actions trigger escalation.

Per-identity subscriptions are one model, not a universal standard. Compare billable account types, minimum commitments and included response services. Check licensing prerequisites rather than assuming every account or integration is included.

Containment limits ongoing misuse, such as restricting a compromised account. Identity recovery restores damaged or deleted identity data and settings. Restoring a backup does not prove that the attacker has lost access. Investigation and validation must accompany recovery.

Before choosing a managed serviceMatch the service to supported identity scenarios, confirm who can authorize response and test both containment and recovery. Check who owns follow-up when a task falls outside the provider's scope.

Use the relevant protection capabilities to close gaps in posture controls or backups. When the remaining need is staffed, after-hours investigation and response for supported EDR/XDR incidents, evaluate MDR.

Explore managed detection and response for your clients.