In Microsoft Defender for Identity (MDI), the goal described - "configure several accounts for attackers to exploit" - refers to creating honeytoken accounts. A honeytoken is a decoy user account deliberately configured to appear valuable (e.g., privileged or high-value) but is not used by legitimate users. Defender for Identity monitors these accounts, and if any authentication or access attempt is detected, it triggers an immediate alert because such activity indicates potential attacker reconnaissance or compromise.
According to Microsoft Defender for Identity documentation, to designate honeytoken accounts, you must explicitly add the accounts themselves under the Honeytoken accounts configuration in the MDI portal.
The portal path is:
Defender for Identity Portal # Configuration # Honeytoken accounts # Add accounts.
Adding accounts to a Sensitive group does not make them honeytokens. Sensitive groups (like Domain Admins or Enterprise Admins) are used by Defender for Identity to track privileged account activities and detect lateral movement, but they are not monitored as honeypots.
Therefore, while adding accounts to a Sensitive group increases monitoring visibility for privilege abuse, it does not fulfill the goal of configuring specific accounts as decoy targets for attackers.
Hence, the correct and verified answer is B. No - the described solution does not meet the goal.