RCP Channel BriefingShort Takes from Microsoft’s Channel Community
Blog archive
Semperis Brings Identity Threat Intelligence Into Microsoft Security Operations
Attacks targeting Active Directory and other identity systems can give adversaries access to multiple enterprise resources, making identity-related activity an important part of security investigations. Semperis is bringing its specialized identity threat detection capabilities into Microsoft's security operations environment to help analysts identify and investigate those attacks.
The integration connects Semperis' Lightning identity security platform with Microsoft Sentinel and Microsoft Security Copilot. It allows security teams to incorporate identity-related findings into centralized monitoring and incident response workflows, while using Security Copilot to support investigations with AI-assisted analysis.
By connecting Lightning with Sentinel, organizations can incorporate identity-related security findings into broader threat monitoring and incident response workflows. Microsoft Security Copilot adds AI-assisted investigation capabilities, allowing analysts to use identity security information alongside other organizational security data.
For enterprise security teams, the integration addresses the challenge of investigating attacks that exploit Active Directory and other identity systems to gain unauthorized access. The field-ready integration uses Microsoft-native building blocks including Azure Functions, DCE/DCR, Log Analytics workspace tables, KQL, Security Copilot, and MCP to bring Lightning into the Microsoft security ecosystem.
Identity infrastructure remains a significant target for ransomware operators and other attackers because compromised credentials and permissions can provide access to multiple enterprise resources.
Bringing specialized identity threat intelligence into a centralized security operations environment could reduce the need to switch between separate investigation tools.
The announcement reflects growing demand for integrated security platforms that combine identity protection, threat detection and AI-assisted incident response.
The "RCP Channel Briefing" blog is researched, fact-checked, edited and updated by the editors of RCPmag.com, with writing assistance from AI. To submit your channel company's press release for consideration, contact Ammaarah Mohamed.
Posted by Redmond Channel Partner magazine staff on October 26, 2026