Defender for Identity

• Defender for Identity portal
  The Defender for Identity portal allows the creation of your Defender for Identity instance, displays the data received from Defender for Identity sensors, and enables you to monitor, manage, and investigate threats in your network environment.
• Defender for Identity sensor
  Defender for Identity sensors can be directly installed on the following servers:
  • Domain controllers: The sensor directly monitors domain controller traffic, without the need for a dedicated server, or configuration of port mirroring.
  • AD FS: The sensor directly monitors network traffic and authentication events.
• Defender for Identity cloud service
  Defender for Identity cloud service runs on Azure infrastructure and is currently deployed in the US, Europe, and Asia. Defender for Identity cloud service is connected to Microsoft’s intelligent security graph.

https://docs.microsoft.com/en-us/defender-for-identity/architecture