Microsoft Defender XDR
Defender XDR is your security operations centre in a box. It detects threats across email, endpoints, identity, and cloud apps — and connects the dots between them.
What is Defender XDR?
Think of Defender XDR as a team of security guards watching different parts of a building — but they all talk to each other.
One guard watches the mailroom (Defender for Office 365 — catches phishing emails). Another watches the computer lab (Defender for Endpoint — detects malware on devices). A third watches the front desk (Defender for Identity — spots suspicious logins). And a fourth watches the third-party shops in the building (Defender for Cloud Apps — monitors SaaS apps).
What makes XDR special: when one guard spots something suspicious, they automatically alert the others. A phishing email (mailroom) that leads to malware (computer lab) that triggers a suspicious login (front desk) → XDR connects all three into ONE incident.
The Defender XDR family
| Feature | What It Protects | Key Capabilities |
|---|---|---|
| Defender for Office 365 | Email and collaboration (Outlook, Teams, SharePoint) | Anti-phishing, anti-malware, safe attachments, safe links, BEC detection |
| Defender for Endpoint | Devices (Windows, Mac, Linux, mobile) | Endpoint detection and response (EDR), vulnerability management, attack surface reduction |
| Defender for Identity | On-premises Active Directory | Lateral movement detection, compromised credential alerts, reconnaissance activity |
| Defender for Cloud Apps | SaaS applications (M365 + third-party) | Shadow IT discovery, app governance, session controls, anomaly detection |
Key exam concept: The exam tests whether you know which Defender component protects which area. The mnemonic: Office = email, Endpoint = devices, Identity = sign-ins, Cloud Apps = SaaS applications.
How XDR connects the dots
The power of XDR is correlation. A single attack often crosses multiple domains:
- 📧 Phishing email arrives (Defender for Office 365 detects it)
- 👆 User clicks the link → malware downloaded (Defender for Endpoint detects it)
- 🔑 Malware steals credentials → suspicious login from new location (Entra ID Protection flags impossible travel)
- 📤 Attacker uses stolen credentials to access SharePoint (Defender for Cloud Apps detects it)
Without XDR: 4 separate alerts in 4 separate tools. The admin might not connect them. With XDR: 1 correlated incident showing the full attack chain. The admin sees the complete picture.
Scenario: Northwave stops an attack
Jordan (Northwave’s CISO) gets ONE incident alert in the Defender portal:
Incident: Credential phishing leading to data exfiltration
- 📧 Email from “IT Support” with a fake password reset link → blocked by Safe Links
- 💻 3 users clicked before Safe Links kicked in → Defender for Endpoint quarantined malware
- 🔑 1 user’s credentials were captured → Entra ID Protection flagged impossible travel (login from Auckland then London in 10 minutes)
- 📁 Attacker accessed 5 SharePoint files before being blocked → Defender for Cloud Apps session terminated
XDR automated response: Blocked the attacker’s IP, forced password reset for affected user, quarantined the phishing email from all inboxes.
Total time from first email to full containment: 4 minutes. Without XDR, this could have taken hours with separate tools.
Threat intelligence
Microsoft’s threat intelligence comes from:
- Microsoft Threat Intelligence Center (MSTIC) — tracks nation-state actors
- Trillions of signals daily — from Windows, Azure, M365, Bing, LinkedIn
- Dark web monitoring — checks if your organisation’s credentials appear in breaches
This intelligence feeds into Defender XDR automatically — you don’t configure it, but it’s important to know it exists for the exam.
🎬 Video walkthrough
🎬 Video coming soon
Microsoft Defender XDR — AB-900 Module 8
Microsoft Defender XDR — AB-900 Module 8
~9 minFlashcards
Knowledge Check
A phishing email is sent to 50 Northwave employees. 5 users click the link and download malware. 1 user's credentials are stolen and used to access SharePoint files. Which Defender XDR components are involved in detecting this attack chain?
Next up: Microsoft Entra — the identity and access management hub that controls who gets in and what they can do.