Defender XDR

Microsoft Defender XDR (Extended Detection and Response) is the unified portal at security.microsoft.com that correlates signals from across the Microsoft Defender family — Defender for Office 365 (email), Defender for Endpoint (devices), Defender for Identity (AD/Entra), Defender for Cloud Apps (SaaS), and Defender for Cloud (Azure workloads) — into single incidents. Provides advanced hunting in KQL, automated investigation and response (AIR), automated attack disruption, threat analytics, and Microsoft Sentinel integration. Formerly called Microsoft 365 Defender before the 2023 rebrand. The unified surface where the SOC works across Microsoft security products.

Worked example

An analyst opens an incident in Defender XDR that automatically grouped a suspicious sign-in, a subsequent mailbox rule creation (an attacker hiding replies), and an outbound phishing email sent from the compromised account — three alerts, generated by three different Defender components, that would once have appeared as three unrelated tickets in three different portals. Automated investigation and response has already isolated the affected device and disabled the mailbox rule; the analyst's job is to confirm the automated remediation was correct and decide whether to reset the user's credentials, rather than manually stitching the timeline together from scratch.

Common pitfalls

Assuming Defender XDR replaces the individual Defender product portals entirely is a common misconception — it's a correlation and investigation layer sitting on top of them, and some deep configuration (specific Defender for Endpoint device policies, for instance) still happens in that product's own admin surface, not in the unified portal. Ignoring advanced hunting in KQL because the automated incident view already surfaces the obvious alerts misses that many real investigations need a custom query to confirm scope — "did this same attacker technique hit any other mailbox in the tenant" isn't always a question the default incident view answers on its own. And treating every automatically-correlated incident as equally urgent, without checking the underlying severity and asset criticality Defender XDR assigns, leads to alert fatigue that undermines the whole point of automatic correlation in the first place.