Identity Threat Detection and Response provides security for identity infrastructure such as user accounts on Microsoft (Like email, Active Directory, Entra/Azure AD) against exploitation or takeovers by threat actors. ITDR does this by looking at a variety of info such as the users normal behavioral patterns, suspicious login attempts, login attempts at a place that would be impossible to travel to within a given timeframe and more. ITDR can automatically lock down accounts that may be compromised, and notify IT personnel so that the threat can be remediated. In many cases this remediation is automatic in order to prevent damage to the account or tenant. This is even more critical when a user has a high level of permissions such as an administrator or global administrator. Attackers frequently target user identities, especially those with a high level of permissions, to gain initial access and then move laterally into other systems undetected. ITDR can also protect against token theft where an attacker can hijack a legitimate user session, bypassing Multi Factor Authentication (MFA) and gaining instant access to an account from something as innocuous as following a link in a phishing email.