Aorato was an enterprise identity-security company acquired by Microsoft on 13 November 2014. Its work focused on suspicious activity involving Windows Server Active Directory. Microsoft subsequently used technology from the acquisition in Advanced Threat Analytics. For readers looking for the modern Microsoft product in this area, Microsoft Defender for Identity is the relevant starting point.
This is an independent historical explainer published by Impulsec. It is not Aorato’s official website, a Microsoft support service or a hands-on review of the original product. It explains the company’s significance and distinguishes its legacy from today’s security tools.
What was Aorato?
Aorato developed technology to recognise potentially suspicious behaviour inside corporate networks. Microsoft described its approach as learning normal activity and identifying anomalies, supported by an Organizational Security Graph: a continuously updated view of people and machines accessing Active Directory. These descriptions explain the intended approach, not an independent measurement of its detection accuracy.
The underlying question was practical: even when a system accepts an account’s credentials, does the account’s behaviour make sense? A successful authentication does not, by itself, establish that the person using the account is its legitimate owner.
When did Microsoft acquire Aorato?
Microsoft announced the acquisition on 13 November 2014. Its stated aim was to improve visibility into identity infrastructure and strengthen protection across on-premises and cloud environments. Microsoft’s announcement did not disclose a purchase price, so reported deal estimates should not be treated as confirmed terms. See Microsoft’s original acquisition announcement.
How Aorato connects to Microsoft’s later security products
The clearest documented link is Microsoft Advanced Threat Analytics, or ATA. In its 2015 Ignite material, Microsoft explicitly described ATA as technology based on its acquisition of Aorato. ATA applied behavioural analysis to enterprise security, giving the acquired technology a place in Microsoft’s product portfolio. See Microsoft’s 2015 ATA presentation.
| Technology | How to understand it |
|---|---|
| Aorato | The acquired company and its historical identity-security technology. |
| Microsoft Advanced Threat Analytics | The later on-premises Microsoft product based on the acquisition; now out of support. |
| Microsoft Defender for Identity | The current Microsoft service to investigate for identity-threat detection and Microsoft’s recommended migration destination for ATA customers. |
This is a technology lineage, not a claim that today’s service is an unchanged Aorato product. Product architecture, integrations and supported capabilities evolve. Nor does the acquisition mean that every Microsoft security feature originated with Aorato.
Why Active Directory was the focus
Active Directory is part of the identity infrastructure used to manage access to organisational resources. That makes identity behaviour an important security concern alongside the security of individual devices. An organisation needs to consider both what an account is permitted to do and whether its activity suggests misuse.
Impulsec already has historical coverage of an Active Directory authentication disclosure involving RC4-HMAC and Windows account disabling and Kerberos ticket behaviour. These are historical discussions, not evidence that every present-day Windows deployment has the same behaviour or that old mitigation advice remains sufficient.
That distinction matters when reading security archives. A historical finding needs its original technical context: affected systems, protocol configuration, contemporary vendor response and subsequent changes. A recent webpage date does not make an old finding a newly discovered vulnerability.
What identity-threat detection means today
Microsoft describes Defender for Identity as analysing identity signals with behavioural analytics, threat intelligence and known attack patterns. Its alerts provide investigation context in the Microsoft Defender portal, where identity information can be correlated with other security signals. Read the current Defender for Identity overview for supported coverage.
An unusual event is a reason to investigate, not automatically proof of malicious activity. For example, a new administrative task may be authorised, while activity through a familiar account may not be. The value of monitoring depends on the evidence it collects and the team’s ability to interpret and respond to it.
Identity detection also differs from protection centred on devices. Our endpoint security vs antivirus explainer covers that separate layer. These functions can complement each other; neither a consumer antivirus subscription nor a password manager is a like-for-like replacement for an enterprise identity-detection platform.
Is Advanced Threat Analytics still supported?
No. Microsoft states that ATA mainstream support ended on 12 January 2021 and extended support ended on 13 January 2026. It no longer receives updates, including security updates. Microsoft recommends migration to Defender for Identity. See the official support-status and migration guidance.
If your organisation still runs ATA, review migration requirements with the people responsible for identity infrastructure and security operations. Do not remove existing monitoring before its replacement has been deployed and its coverage verified.
What should former Aorato users consider now?
My recommendation is to start with the security requirement, not a search for an old installer. For a Microsoft-centred environment, Defender for Identity is the logical product to evaluate in this lineage. That is an editorial assessment of relevance, not a claim that I tested it against competing platforms.
When evaluating a supported platform, ask which identities it covers, what information it collects, how alerts are investigated and who is responsible for response. Check current deployment documentation, licensing, data handling and integration requirements before committing to a purchase.
| Your requirement | What to evaluate | Question to ask |
|---|---|---|
| Suspicious account activity | Identity threat detection and response | Does it cover the identity systems we actually use? |
| Risky permissions and configuration | Identity security posture assessment | Does it explain which weaknesses to address first? |
| Administrative access | Privileged-access controls | Can we reduce unnecessary standing privileges? |
| Operational resilience | Recovery planning and tested backups | Can we restore identity services after a serious incident? |
These are evaluation categories, not a ranked list of interchangeable products. One platform may address several requirements, while another may address only one. Avoid choosing solely on a feature checklist without understanding deployment and operational responsibilities.
Aorato’s relevance for individual readers
Aorato’s history concerns organisational identity infrastructure, not parental monitoring or consumer identity-theft insurance. If you are protecting personal accounts rather than administering a business directory, start with Impulsec’s identity and privacy protection coverage. The audience and tools are different, even though both subjects involve protecting access and personal information.
Frequently asked questions
When did Microsoft acquire Aorato?
Microsoft announced its acquisition of Aorato on 13 November 2014. Its announcement did not disclose the purchase price.
Did Aorato become Microsoft Defender for Identity?
Microsoft explicitly linked Advanced Threat Analytics to its Aorato acquisition. Defender for Identity is the current Microsoft service recommended for ATA customers, but it should not be described as the unchanged original Aorato product.
Is Microsoft Advanced Threat Analytics still supported?
No. Extended support ended on 13 January 2026. Microsoft says ATA no longer receives updates, including security updates, and recommends migration to Defender for Identity.
Was Aorato a parental-control app?
No. Aorato focused on enterprise identity security and Active Directory activity, not parental controls or family device monitoring.
Is this the official Aorato website?
No. This is an independent historical resource published by Impulsec, not Aorato’s official website or a Microsoft support channel.
Aorato research and identity-security resources
Aorato’s research covered authentication weaknesses and the use of legitimate credentials in attacks. These resources explain those subjects with historical context and current documentation.
- Historical Active Directory RC4-HMAC disclosure
- Aorato’s reconstruction of the Target attack
- Windows account disabling, tickets and existing sessions
- Password-hash and Kerberos-ticket reuse
- RDP Restricted Admin and Remote Credential Guard
- Windows smart card logon and its security limits
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.