Domain 3 of 4 · Chapter 4 of 4

Microsoft Defender XDR

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Microsoft Certified: Security, Compliance, and Identity Fundamentals premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • One suite, one surface each, one portal
  • Defender for Endpoint and Defender for Office 365
  • Defender for Identity and Defender for Cloud Apps
  • Vulnerability Management and Threat Intelligence
  • The Defender portal: alerts become incidents
  • Two boundaries the Defender brand hides
  • Exam pattern recognition

Which Defender component defends which surface

ComponentAttack surface it defendsSignature capabilityFormer name
Defender for EndpointDevices and endpointsEDR, attack surface reduction, next-generation protection, automated investigation and remediationMicrosoft Defender ATP
Defender for Office 365Email and collaboration (Exchange, Teams, SharePoint, OneDrive)Safe Links, Safe Attachments, anti-phishingOffice 365 ATP
Defender for IdentityOn-premises Active Directory Domain ServicesDomain-controller sensor, lateral-movement and identity-attack detectionAzure ATP
Defender for Cloud AppsSaaS applicationsShadow-IT discovery, app governance, session control (CASB)Microsoft Cloud App Security (MCAS)
Defender Vulnerability ManagementDevice posture (assets and vulnerabilities)Continuous asset discovery, vulnerability assessment, risk-based prioritizationgrew out of Defender for Endpoint threat and vulnerability management
Defender Threat IntelligenceExternal threat landscapeThreat-actor and infrastructure intelligence for hunting and investigationbuilt on RiskIQ
Microsoft Defender portalAll of the above, unifiedCorrelates alerts into incidents; hosts unified security operations with SentinelMicrosoft 365 Defender portal

Decision tree

A device or endpoint?Email or collaborationcontent?An on-premisesAD DS identity?A SaaS application?A cloud identity inMicrosoft Entra ID?Defender for EndpointDefender for Office 365Defender for IdentityDefender for Cloud AppsEntra ID Protectioncloud identity, not XDRDefender for CloudAzure resource, not XDRYesYesYesYesYesNoNoNoNoNoAll alerts correlate into incidents in the Microsoft Defender portal
Cheat sheet

Cheat sheet

  • Defender XDR is a suite with one service per attack surface
  • Defender for Endpoint defends devices with EDR
  • Defender for Office 365 defends email and collaboration
  • Safe Links checks URLs at click time; Safe Attachments detonates files
  • Defender for Office 365 Plan 1 protects, Plan 2 investigates
  • Defender for Identity defends on-premises AD DS from a domain-controller sensor
  • Defender for Identity is on-prem AD; Entra ID Protection is cloud identity
  • Defender for Cloud Apps is the CASB for SaaS apps
  • Defender Vulnerability Management measures posture, not live attacks
  • Defender Threat Intelligence supplies external adversary context
  • An incident is correlated alerts; an alert is one detection
  • The Microsoft Defender portal is where signals correlate
  • Defender XDR services are Zero Trust signal sources
  • Attack surface reduction closes off techniques before they run
  • Defender Vulnerability Management inventories all assets and discovers unmanaged devices
  • A lower Defender Vulnerability Management exposure score means less vulnerable devices
  • Defender Vulnerability Management blocks vulnerable apps and files remediation requests to IT
  • Defender for Identity Lateral Movement Paths show how attackers reach sensitive accounts
  • Defender Threat Intelligence data sets expose an indicator's raw infrastructure
  • Defender Threat Intelligence scores indicator reputation and publishes analyst articles
  • Defender for Office 365 impersonation protection uses mailbox intelligence and is absent from basic anti-phishing
  • Microsoft 365 fights spoofing with SPF, DKIM, DMARC, and spoof intelligence

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. What is Microsoft Defender XDR?
  2. Microsoft Defender for Endpoint
  3. Microsoft Defender for Office 365 (Plan 1 and Plan 2)
  4. Microsoft Defender for Identity overview
  5. Microsoft Defender for Cloud Apps overview
  6. The Microsoft Defender portal
  7. Endpoint detection and response (EDR) in Microsoft Defender for Endpoint
  8. Attack surface reduction overview
  9. Safe Attachments in Microsoft Defender for Office 365
  10. Safe Links in Microsoft Defender for Office 365
  11. Microsoft Defender for Identity architecture
  12. What is Microsoft Entra ID Protection?
  13. Set up Cloud Discovery in Microsoft Defender for Cloud Apps
  14. Microsoft Defender for Cloud Apps session policies
  15. Microsoft Defender Vulnerability Management
  16. What is Microsoft Defender Threat Intelligence (Defender TI)?
  17. Incidents in the Microsoft Defender portal
  18. Investigate alerts in Microsoft Defender XDR
  19. Microsoft unified security operations platform
  20. What is Microsoft Defender for Cloud?