| Category | Function | Share | Rank | Negative rate | Labels | Quadrant | Since September 2026 |
|---|---|---|---|---|---|---|---|
| Identity threat detection and response | Identity and access | 2% | 8 of 105 | 0% | 5 | under 10 labels · led by Huntress Managed ITDR at 51% |
| Model | First choice | Alternative | Mention | Negative | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 0 | 0 | 0 | 0 | 0 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.1 Fast | 0 | 0 | 0 | 0 | 0 |
| Mistral Small | 0 | 0 | 0 | 0 | 0 |
| DeepSeek V4 Flash | 0 | 1 | 1 | 0 | 2 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 0 | 0 |
| Kimi K2 | 0 | 1 | 0 | 0 | 1 |
| GLM 4.7 FlashX | 1 | 0 | 0 | 0 | 1 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 0 | 0 | 0 | 0 |
Verbatim evidence the judge attached to positive labels.
“Start with Microsoft Defender for Identity if you have Microsoft 365 E5, as it's included and integrates seamlessly.” GLM 4.7 FlashX · ITDR · direct prompt · first choice
“If You're Microsoft-Heavy: Microsoft Defender for Identity + Entra ID Protection” Kimi K2 · ITDR · direct prompt · alternative
“Choose Microsoft if you are a Microsoft shop.” GPT-5.4 mini · ITDR · comparative prompt · alternative
“Best if You're Already in Microsoft E5” DeepSeek V4 Flash · ITDR · direct prompt · alternative
Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.
Citations exist only for the models that return a source list, five of the fourteen in this edition, so these counts come from 14 of the 14 answers that named Microsoft Defender for Identity / Entra ID Protection and are not a share of its labels.
Fifty-nine of the sixty-eight domain citations in answers naming Microsoft Defender for Identity / Entra ID Protection came from somebody else's page.
Pages are listed as the models cited them.
Search figures are US estimates from DataForSEO, read October 5, 2026; AI search demand is its modeled, directional estimate, not a count of queries to any assistant. The answers are this edition's. Two measurements side by side: neither is read as the cause of the other.
An email the morning each edition publishes: where this product moved, where it held, and by how much against the noise floor. One address, confirmed by a click; a stop link in every email.
Already following? Everything you follow, with a stop for each.
What Microsoft Defender for Identity / Entra ID Protection's own pages state, read October 5, 2026: microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals/what-is-identity-theft, microsoft.com/en-us/microsoft-365/microsoft-defender-for-individuals/identity-protection-and-prevention. A claimed page can correct any of them.
Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Microsoft Defender for Identity / Entra ID Protection's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Microsoft Defender for Identity / Entra ID Protection, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.
A new claim receives the current edition's vendor brief for Microsoft Defender for Identity / Entra ID Protection by email, built from the raw record of the edition. It shows: