https://www.solvingmicrosoft365.com/guides/category/security New and reviewed Microsoft Defender (Security) guides. Defender XDR, Endpoint, Office 365, Identity, and Sentinel. en Solving Microsoft 365 Sat, 05 Sep 2026 08:00:00 GMT https://www.solvingmicrosoft365.com/guides/defender-external-attack-surface-management https://www.solvingmicrosoft365.com/guides/defender-external-attack-surface-management#2026-09-05 Sat, 05 Sep 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender EASM discovers your organisation's internet-facing assets — including the ones you didn't know about. https://www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365 https://www.solvingmicrosoft365.com/guides/how-to-block-a-compromised-account-in-microsoft-365#2026-09-03 Thu, 03 Sep 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to block a compromised Microsoft 365 account in ten minutes: disable sign-in, revoke sessions, reset password and MFA, kill inbox rules and forwarding. https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-vs-sentinelone https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-vs-sentinelone#2026-09-03 Thu, 03 Sep 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Endpoint vs SentinelOne Singularity: autonomous response and rollback vs Microsoft XDR correlation, platform coverage, MSP fit, and licensing. https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-vs-crowdstrike https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-vs-crowdstrike#2026-09-03 Thu, 03 Sep 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Endpoint vs CrowdStrike Falcon: detection quality, platform coverage, the SOC experience, licensing, and what the July 2024 outage changed. https://www.solvingmicrosoft365.com/guides/defender-phishing-message-investigation-runbook https://www.solvingmicrosoft365.com/guides/defender-phishing-message-investigation-runbook#2026-09-02 Wed, 02 Sep 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Runbook for a phish that landed: find every copy, purge it from mailboxes, find who clicked, submit it so filters learn, and work out why it got through. https://www.solvingmicrosoft365.com/guides/defender-for-office-365-explained https://www.solvingmicrosoft365.com/guides/defender-for-office-365-explained#2026-08-31 Mon, 31 Aug 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) What Defender for Office 365 adds on top of EOP — Safe Links, Safe Attachments, AIR, attack simulation — plus Plan 1 vs Plan 2 and the settings worth tuning. https://www.solvingmicrosoft365.com/guides/microsoft-defender-products-explained https://www.solvingmicrosoft365.com/guides/microsoft-defender-products-explained#2026-08-30 Sun, 30 Aug 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Which Microsoft Defender is which: Endpoint, Office 365, Identity, Cloud Apps, Business, XDR, Cloud, Antivirus — what each does and which licence gets it. https://www.solvingmicrosoft365.com/guides/defender-xdr-and-attack-surface https://www.solvingmicrosoft365.com/guides/defender-xdr-and-attack-surface#2026-08-30 Sun, 30 Aug 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How Microsoft Defender XDR unifies Defender for Office, Endpoint, Identity, and Cloud Apps into a single SOC workflow. https://www.solvingmicrosoft365.com/guides/defender-for-iot-explained https://www.solvingmicrosoft365.com/guides/defender-for-iot-explained#2026-08-30 Sun, 30 Aug 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for IoT secures the devices EDR can't reach — OT, ICS, and IoT. Here's how it works and when it's worth deploying. https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-explained https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-explained#2026-08-30 Sun, 30 Aug 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Endpoint is Microsoft's EDR/XDR platform for laptops, servers, and mobile. Here's what it does. https://www.solvingmicrosoft365.com/guides/zero-trust-in-microsoft-365 https://www.solvingmicrosoft365.com/guides/zero-trust-in-microsoft-365#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) What zero trust actually means in a Microsoft 365 context — and the concrete controls that get you there. https://www.solvingmicrosoft365.com/guides/sentinel-analytic-rules https://www.solvingmicrosoft365.com/guides/sentinel-analytic-rules#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How analytic rules work in Sentinel — types, tuning, and writing custom detections. https://www.solvingmicrosoft365.com/guides/ransomware-preparedness-for-microsoft-365 https://www.solvingmicrosoft365.com/guides/ransomware-preparedness-for-microsoft-365#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to harden a Microsoft 365 tenant against ransomware — prevention, detection, response, and recovery. https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to onboard Microsoft Sentinel — workspace setup, data connectors, and starting analytic rules. https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-for-microsoft-365 https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-for-microsoft-365#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How Microsoft Sentinel ingests Microsoft 365 signals and extends Defender XDR into a full SIEM. https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-cost-optimization https://www.solvingmicrosoft365.com/guides/microsoft-sentinel-cost-optimization#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to control Microsoft Sentinel costs — ingestion tuning, commitment tiers, retention, and data tiering. https://www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment https://www.solvingmicrosoft365.com/guides/microsoft-defender-for-identity-deployment#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to plan and roll out Defender for Identity sensors — DCs, AD FS, Entra Connect, and tuning. https://www.solvingmicrosoft365.com/guides/microsoft-365-security-baselines https://www.solvingmicrosoft365.com/guides/microsoft-365-security-baselines#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) The minimum security configuration every Microsoft 365 tenant should have — and how to get there. https://www.solvingmicrosoft365.com/guides/microsoft-365-security-and-compliance https://www.solvingmicrosoft365.com/guides/microsoft-365-security-and-compliance#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) A practical tour of the Microsoft 365 security and compliance stack — Defender, Purview, Entra, and how they fit together. https://www.solvingmicrosoft365.com/guides/kql-primer-for-defender-xdr https://www.solvingmicrosoft365.com/guides/kql-primer-for-defender-xdr#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) A practical introduction to Kusto Query Language for Microsoft Defender XDR and Sentinel hunting. https://www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting https://www.solvingmicrosoft365.com/guides/defender-xdr-advanced-hunting#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to use Defender XDR advanced hunting effectively — tables, common queries, and threat-hunting patterns. https://www.solvingmicrosoft365.com/guides/defender-vulnerability-management https://www.solvingmicrosoft365.com/guides/defender-vulnerability-management#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How Defender for Endpoint's vulnerability management surfaces CVEs, misconfigurations, and prioritises remediation. https://www.solvingmicrosoft365.com/guides/defender-threat-intelligence https://www.solvingmicrosoft365.com/guides/defender-threat-intelligence#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How Microsoft Defender XDR integrates threat intelligence — built-in feeds, custom IoCs, and Defender TI as a separate product. https://www.solvingmicrosoft365.com/guides/defender-quarantine-workflow https://www.solvingmicrosoft365.com/guides/defender-quarantine-workflow#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How users and admins work with quarantine — release, request, report, and the policy decisions behind it. https://www.solvingmicrosoft365.com/guides/defender-for-identity-explained https://www.solvingmicrosoft365.com/guides/defender-for-identity-explained#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Identity detects identity-based attacks against on-prem Active Directory and Entra ID. Here's how it works. https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-mac https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-mac#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Deploying and managing Microsoft Defender for Endpoint on Mac fleets via Intune. https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-linux https://www.solvingmicrosoft365.com/guides/defender-for-endpoint-linux#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Deploying Microsoft Defender for Endpoint on Linux servers and workstations — distributions, packaging, and integration. https://www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained https://www.solvingmicrosoft365.com/guides/defender-for-cloud-apps-explained#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Cloud Apps is Microsoft's CASB — discovering, monitoring, and controlling SaaS app usage. https://www.solvingmicrosoft365.com/guides/defender-for-business-explained https://www.solvingmicrosoft365.com/guides/defender-for-business-explained#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Defender for Business is the SMB-targeted EDR product bundled with Microsoft 365 Business Premium. https://www.solvingmicrosoft365.com/guides/defender-attack-disruption https://www.solvingmicrosoft365.com/guides/defender-attack-disruption#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) Automatic Attack Disruption is Defender XDR's ability to contain in-progress attacks automatically — what it does and how. https://www.solvingmicrosoft365.com/guides/defender-antivirus-exclusions https://www.solvingmicrosoft365.com/guides/defender-antivirus-exclusions#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to design Defender Antivirus exclusions safely — minimising scope while accommodating legitimate application needs. https://www.solvingmicrosoft365.com/guides/defender-antivirus-configuration https://www.solvingmicrosoft365.com/guides/defender-antivirus-configuration#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to configure Microsoft Defender Antivirus for Windows endpoints — the settings that matter and how to manage them. https://www.solvingmicrosoft365.com/guides/bec-response-playbook https://www.solvingmicrosoft365.com/guides/bec-response-playbook#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to respond to a confirmed BEC incident in Microsoft 365 — containment, investigation, remediation, and prevention. https://www.solvingmicrosoft365.com/guides/attack-simulation-training https://www.solvingmicrosoft365.com/guides/attack-simulation-training#2026-05-01 Fri, 01 May 2026 08:00:00 GMT Emil Björk Microsoft Defender (Security) How to run controlled phishing simulations and embedded training to harden users against real attacks.