Product

Microsoft Defender for Identity Honeytoken Tags

Documented feature tagging honeytoken accounts and devices; sign-ins generate Defender for Identity alerts.

HoneytokenIdentity

Critical reading · Sep 15, 2026

What the source supports

Microsoft documents honeytoken tags for accounts and devices.

Question for evaluation

Which legitimate activity can touch the account and create noise?

This note is bounded by the material shown under “Review depth”. It is not an independent test.

Evidence limits

A tag requires account governance; this site does not measure effectiveness.

Sources and provenance

  1. Microsoft Defender for Identity Honeytoken Tags
    source-page · 2026-09-15

Reviewed: 2026-09-15. This record may change when new evidence is found.

RIS · BibTeX

Related resources

Open software

Canarytokens

Review: RepositoryCritical reading

Open project for creating decoy tokens that alert when someone uses them.

IdentityCloudHoneytoken