Azure ATP is cloud-based but involves installing sensors on-prem to help manage risks in both locations and more comprehensively protect users. It involves the following:

• Learning-based analytics and suspicious behavior identification
• Protecting AD credentials
• Reducing attack surfaces
• Fast and clear incident reporting

Before you can use Azure ATP, you'll need to create and configure your Azure ATP instance. These are the basic steps. You would repeat these steps for each unique AD forest:

1. Create an instance in the Azure ATP portal.
2. Provide local Active Directory forest credentials.
3. Download a sensor setup.
4. Install a sensor on a dedicated server or a domain controller.
5. Configure the sensor.

It's recommended to install one sensor per Active Directory forest. The following screenshot shows how you're able to provide multiple...