Product

Microsoft Defender for Identity Honeytoken Tags

Documented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.

HoneytokenIdentity

Critical reading · Sep 15, 2026

What the source supports

Microsoft documents honeytoken tags for accounts and devices.

Question for evaluation

Which legitimate activity can touch the account and create noise?

This note is bounded by the “Material reviewed” shown in the record. It is not an independent test.

Evidence limits

A tag requires account governance; this site does not measure effectiveness.

Sources and provenance

  1. Microsoft Defender for Identity Honeytoken Tags
    Public page · 2026-09-15

Reviewed: 2026-09-15. This record may change when new evidence is found.

RIS · BibTeX

Related resources

Open software—

Canarytokens

Material reviewed: Repository metadataCritical reading

Open project for creating decoy tokens that alert when someone uses them.

IdentityCloudHoneytoken