baselining 1 Microsoft Defender for Identity Deep Dive — Part 2: Detection Logic, Baselines, and Limits Apr 8, 2026