Defender XDR and attack-surface management

Microsoft Defender XDR (Extended Detection and Response) is the unified portal and engine that ties Microsoft's Defender products together: Defender for Office 365 (email), Defender for Endpoint (devices), Defender for Identity (AD/Entra), Defender for Cloud Apps (SaaS), and — through integration — Defender for Cloud (Azure workloads), Defender for IoT (OT and IoT devices), and Microsoft Sentinel (SIEM).

Why XDR matters

A modern attack rarely touches only one workload. A phishing email leads to credential theft, which leads to a sign-in from a new device, which leads to lateral movement on AD, which leads to data exfiltration via a sanctioned SaaS app. Each of those events is detected by a different product, but to a human analyst they're one incident.

XDR's core trick is correlation: it groups related alerts from different products into a single incident, with the full timeline, affected entities, and recommended response actions.

The XDR portal

The Defender XDR portal at security.microsoft.com is one place for:

• Incidents and alerts — correlated, prioritised, with full attack timelines.
• Advanced hunting — Kusto Query Language (KQL) across all Defender telemetry.
• Automated investigation and response (AIR) — playbooks that triage and remediate automatically.
• Threat analytics — Microsoft Threat Intelligence reports with tenant-specific exposure.
• Attack surface management — discovery of internet-facing assets and weaknesses.
• Email and collaboration — quarantine, submissions, message trace.
• Endpoints — device inventory, vulnerability management, response actions.
• Identities — account-centric view of risk and detections.
• Cloud apps — connected app inventory and SSPM findings.

Microsoft Sentinel integration

Sentinel is Microsoft's full SIEM/SOAR. It now lives inside the Defender XDR portal as a unified surface: Defender XDR for first-party signals, Sentinel for broader log ingestion (third-party firewalls, network gear, custom apps) and longer retention. The same KQL hunts work across both.

Microsoft Security Copilot

Microsoft Security Copilot is a paid AI assistant for SOC analysts, embedded in Defender XDR. It can summarise an incident in plain English, suggest hunting queries, write KQL from natural-language descriptions, and draft incident reports. It's an add-on to Defender XDR, billed per Security Compute Unit (SCU) per hour.

Operational model

XDR works best when the SOC organises around it:

• A small team of analysts triage incidents in the portal, escalating from low to high priority.
• AIR playbooks handle the routine cases (clear phishing, common malware).
• Advanced hunting and threat-intel-driven proactive hunts catch what detections miss.
• Lessons feed back into Conditional Access, ASR rules, and Purview policies — closing the loop.

For Microsoft 365 customers on E5, XDR is the centrepiece of the security stack. It's where the investment pays off.

What "attack surface management" specifically adds

It's easy to read Defender XDR purely as an internal detection-and-response tool and miss the attack surface management (Defender EASM) angle entirely — this capability scans for internet-facing assets the organisation may not even know it has: forgotten subdomains, exposed dev/test environments, misconfigured cloud storage, expired certificates on public endpoints. This is meaningfully different from every other Defender product in the suite, which all assume the asset in question is already known to the tenant (a licensed mailbox, an enrolled device, a connected SaaS app) — EASM's entire value proposition is finding the things that were never inventoried in the first place, which is exactly the kind of shadow-IT-adjacent gap that internal-signal-only tools structurally can't see.

Frequently asked questions

Does a smaller organisation without a dedicated SOC get any value from Defender XDR? Yes, though the operational model differs — a small IT team without 24/7 analysts still benefits from AIR's automated remediation for routine cases and from the unified incident view replacing several separate per-product consoles; the advanced hunting and proactive threat-hunting capabilities matter less without dedicated analyst time to use them, but the baseline correlation and automation value doesn't require a large team to benefit from.

Is Microsoft Sentinel required to get value from Defender XDR? No — Defender XDR is fully functional as a standalone correlation and response platform for Microsoft's own first-party signals; Sentinel becomes valuable specifically when an organisation needs to ingest and correlate log sources Defender XDR doesn't natively cover (non-Microsoft firewalls, on-prem network gear, custom application logs) or needs longer retention than Defender XDR provides on its own.