Azure ATP is used to detect and investigate advanced attacks, compromised identities, and insider threats. Thanks to behavioral analytics in the backend, it provides very fast threat detection and also reduces the fatigue of false positives. Furthermore, it provides focused essential information using the Azure ATP attack timeline. Azure ATP is simple to work with, and the architecture is quite easy to understand because there are only two components per service and a downloadable sensor, which monitors local traffic, that is installed directly on your Domain Controllers. The sensors use dynamic resource limitation based on the domain controller's load.

There is another, more complex deployment method available, however, which uses a standalone sensor on a dedicated server and requires the configuration of port-mirroring from the Domain Controllers...