In short: SentinelOne Singularity Identity protects Active Directory and cloud identity providers such as Microsoft Entra ID and Okta. It combines Identity Security Posture Management (formerly Ranger AD), Identity Security for IdPs (formerly Ranger AD Protect) and Identity Detection and Response with deception. Each part is licensed by the users or identities protected, monthly or annually.
What Singularity Identity is
Attackers increasingly sign in with stolen credentials rather than breaking in. Singularity Identity is SentinelOne's identity security product: it finds weaknesses in your directory before attackers do, spots credential theft and privilege escalation as it happens, and contains compromised accounts.
It covers on-premises Active Directory and cloud identity providers including Microsoft Entra ID and Okta, and SentinelOne also names Ping, SecureAuth and Duo among the identity providers it covers. Because it shares the Singularity agent and console, identity alerts are correlated with endpoint alerts, so a suspicious login and the device it came from appear in one investigation.
The Singularity Identity components
| Component | What it does | Licensed by |
|---|---|---|
| Identity Security Posture Management (formerly Ranger AD) | Continuously assesses Active Directory and cloud identity providers for misconfigurations, risky privileges and exposures, with guidance to fix them | User or identity |
| Identity Security for IdPs (formerly Ranger AD Protect) | Extends protection to cloud identity providers such as Microsoft Entra ID and Okta | User or identity |
| Identity Detection and Response | Detects credential theft, privilege escalation and lateral movement, uses deception to mislead attackers, and automates containment such as disabling an identity or forcing a password change | User or identity |
Many organisations start with posture management to clean up their directory, then add detection and response once the basics are fixed. We confirm exactly which capabilities each component switches on when we quote.
Key capabilities
- Continuous posture assessment of hybrid identity, rather than a one-off audit
- Identity deception: decoy credentials and objects that lure attackers and reveal reconnaissance
- Compromised credential protection, including credentials exposed on the dark web
- Policy-based conditional access with adaptive controls such as session blocking and MFA re-authentication
- Unified endpoint and identity response: isolate the user and the device together from one console
It complements rather than replaces multi-factor authentication. If MFA is not yet in place everywhere, look at Cisco Duo and our identity, MFA and privileged access category.
How Singularity Identity is licensed
Identity components are counted by the users or identities protected, not by devices, on month-to-month or annual-commitment terms. You can buy posture management on its own or combine it with the identity provider and detection and response components.
Singularity Identity sits alongside your SentinelOne endpoint licences, and identity detection works best when your domain controllers and endpoints already run the agent. Ask us for a quote and we will count your user and service accounts first.
Deployment and requirements
We connect Singularity Identity to your Active Directory and cloud identity provider, run the first posture assessment and review the findings with you. Common early fixes include stale privileged accounts, weak delegation, unconstrained Kerberos settings and accounts that should not be able to sign in. We then agree which identity responses should be automatic and which should alert first, so a false positive never locks out the managing director.
How we help
- Count identities properly: we total user, admin and service accounts across Active Directory and your cloud identity provider, because that is what you are licensed on.
- Run the first assessment: we connect posture management and walk through the findings with you in plain English, worst first.
- Fix, then detect: we help close the easy exposures before switching on detection and response, so early alerts are meaningful.
- Agree the guard rails: we set which identity responses are automatic and which only alert, and keep the licence count in step as staff change.
Compare other identity tools in identity, MFA and privileged access.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What was SentinelOne Ranger AD?
Ranger AD was SentinelOne's earlier name for Active Directory assessment. It is now Identity Security Posture Management within Singularity Identity, and Ranger AD Protect is now Identity Security for IdPs.
Does Singularity Identity work with Microsoft Entra ID?
Yes. SentinelOne lists Active Directory, Microsoft Entra ID and Okta among the supported identity platforms, and also names Ping, SecureAuth and Duo.
Is Singularity Identity licensed per user?
Yes. Identity components are counted by the users or identities protected rather than by device. We count user and service accounts before quoting.
Do I need SentinelOne endpoint protection to use Singularity Identity?
Singularity Identity runs on the same Singularity agent and console as SentinelOne's endpoint products, and correlating identity with endpoint activity is where it is strongest, so we normally quote it alongside Singularity Endpoint. We confirm prerequisites when quoting.