Microsoft Defender and XDR

What each Defender product actually protects, how the XDR story ties them together, and where to hunt when something breaks.

For: Security ops teams and admins responsible for the Microsoft security stack.

10 guides in this path

1
Which Microsoft Defender is whichWhich Microsoft Defender is which: Endpoint, Office 365, Identity, Cloud Apps, Business, XDR, Cloud, Antivirus — what each does and which licence gets it.
2
Microsoft Defender for Endpoint explainedDefender for Endpoint is Microsoft's EDR/XDR platform for laptops, servers, and mobile. Here's what it does.
3
Microsoft Defender for Office 365 explainedWhat Defender for Office 365 adds on top of EOP — Safe Links, Safe Attachments, AIR, attack simulation — plus Plan 1 vs Plan 2 and the settings worth tuning.
4
Microsoft Defender for Identity explainedDefender for Identity detects identity-based attacks against on-prem Active Directory and Entra ID. Here's how it works.
5
Microsoft Defender for Cloud Apps explainedDefender for Cloud Apps is Microsoft's CASB — discovering, monitoring, and controlling SaaS app usage.
6
Defender XDR and attack-surface managementHow Microsoft Defender XDR unifies Defender for Office, Endpoint, Identity, and Cloud Apps into a single SOC workflow.
7
Defender XDR advanced hunting workshopHow to use Defender XDR advanced hunting effectively — tables, common queries, and threat-hunting patterns.
8
Defender for Office 365 quarantine workflowHow users and admins work with quarantine — release, request, report, and the policy decisions behind it.
9
Defender Attack DisruptionAutomatic Attack Disruption is Defender XDR's ability to contain in-progress attacks automatically — what it does and how.
10
Defender Threat IntelligenceHow Microsoft Defender XDR integrates threat intelligence — built-in feeds, custom IoCs, and Defender TI as a separate product.

← All paths Browse all guides →