Defender XDR: The Unified Threat Platform

What is XDR?

How XDR differs from SIEM

This is an important exam concept — XDR and SIEM serve different but complementary roles:

XDR and SIEM complement each other — XDR provides depth, SIEM provides breadth

Feature	XDR (Defender XDR)	SIEM (Microsoft Sentinel)
Data sources	Microsoft Defender products (tightly integrated)	Everything — Microsoft, third-party, on-prem, custom
Correlation	Automatic — built-in cross-product intelligence	Rules-based — analytics rules and Fusion engine
Primary strength	Deep, integrated detection within Microsoft ecosystem	Broad visibility across the entire environment
Investigation	Unified incidents with automatic entity mapping	Investigation graph with manual and automated hunting
Response	Built-in automated investigation and response (AIR)	Playbooks via Logic Apps
Best analogy	A specialist team of detectives who share one case board	A citywide surveillance system that feeds one operations center

Key exam point: XDR is an integrated product suite that correlates its own signals. SIEM is a data aggregation platform that collects from any source. Microsoft offers both — and they work together in the unified Defender portal.

The Defender XDR product suite

Defender XDR brings together several Defender products. Each product focuses on a specific attack surface:

Defender for Office 365

Protects email and collaboration tools (Outlook, Teams, SharePoint, OneDrive) from threats like:

• Phishing emails with malicious links or attachments
• Business email compromise (BEC)
• Malware delivered via email

Uses Safe Links (scans URLs at time of click) and Safe Attachments (detonates attachments in a sandbox before delivery).

Defender for Endpoint

Protects devices — laptops, desktops, servers, and mobile devices — from threats like:

• Malware and ransomware
• Fileless attacks (malicious scripts running in memory)
• Credential theft tools

Provides endpoint detection and response (EDR), attack surface reduction rules, and automated investigation capabilities.

Defender for Cloud Apps

Protects cloud applications — both Microsoft and third-party SaaS apps — by providing:

• Shadow IT discovery (which unsanctioned cloud apps are employees using?)
• Threat detection for cloud app sessions
• App governance and policy enforcement (for example, block file downloads from unmanaged devices)

This is Microsoft’s Cloud Access Security Broker (CASB).

Defender for Identity

Protects identity infrastructure — specifically on-premises Active Directory — from threats like:

• Lateral movement (pass-the-hash, pass-the-ticket)
• Reconnaissance (attackers mapping the AD environment)
• Compromised credentials

It monitors domain controller traffic to detect identity-based attacks that start on-premises and move to the cloud.

Defender Vulnerability Management

Provides continuous vulnerability assessment across your environment:

• Discovers software vulnerabilities across all devices
• Prioritises remediation based on threat intelligence and business impact
• Integrates with Defender for Endpoint for device-level visibility

Defender Threat Intelligence (Defender TI)

Provides threat intelligence — information about known attackers, their methods, and indicators of compromise (IOCs). Security teams use this to understand who is attacking them and what techniques they use.

💡 Scenario: Defender XDR correlates a multi-stage attack on SecureBank

Here’s how Defender XDR connects signals from multiple products into one incident:

1. Defender for Office 365 detects a phishing email sent to a SecureBank employee — Sarah in the finance team. The email contains a link to a credential-harvesting page.
2. Defender for Endpoint sees that Sarah clicked the link on her laptop and entered her password on the fake page.
3. Defender for Identity detects that Sarah’s stolen credentials are used to perform LDAP queries against Active Directory — the attacker is mapping the environment (reconnaissance).
4. Defender for Cloud Apps detects that the compromised account accesses a sanctioned SaaS app and begins downloading financial reports.

Without XDR: Each product generates a separate alert. The SOC sees four unrelated alerts across different dashboards. It takes hours to connect them manually.

With XDR: Defender XDR automatically correlates all four signals into a single incident: “Phishing-driven credential theft leading to data exfiltration.” Alex sees the full story in one view, and automated investigation has already isolated Sarah’s device and blocked the compromised account.

The Microsoft Defender portal

The Microsoft Defender portal (security.microsoft.com) is the unified interface for managing security across all Defender XDR products. Key areas:

Portal section	What it shows
Incidents	Correlated groups of alerts from multiple Defender products — one incident tells the full attack story
Alerts	Individual detections from each Defender product
Hunting	Advanced hunting using KQL to search raw security data across all connected products
Secure Score	A single score showing the security posture across identity, devices, apps, and data
Threat Analytics	Reports on active threat campaigns with guidance on whether your environment is exposed
Action Center	Pending and completed remediation actions (automated and manual)

Unified incident view

The most important feature of the Defender portal is the unified incident view. A single incident can contain:

• An email alert from Defender for Office 365
• A device alert from Defender for Endpoint
• An identity alert from Defender for Identity
• A cloud app alert from Defender for Cloud Apps

All correlated into one timeline showing the full attack chain. This saves analysts hours of manual correlation work.

💡 Exam tip: Defender portal questions

When the exam asks about a “unified portal for managing incidents across endpoints, email, identity, and cloud apps” — the answer is the Microsoft Defender portal at security.microsoft.com.

When it asks about “correlated incidents from multiple Defender products” — the answer is the unified incident view in the Defender portal.

When it asks about “proactive threat searching using KQL across Defender data” — the answer is Advanced Hunting in the Defender portal.

🎬 Video walkthrough

🎬 Video coming soon

Defender XDR and the Unified Defender Portal (SC-900)

Defender XDR and the Unified Defender Portal (SC-900)

~9 min

Flashcards

Question

What is XDR and how does it differ from SIEM?

Click or press Enter to reveal answer

Answer

XDR (Extended Detection and Response) is an integrated security platform that correlates signals across endpoints, email, identity, and cloud apps. SIEM collects data from any source (including third-party). XDR provides deep, automatic cross-product correlation; SIEM provides broad visibility. They complement each other — XDR for depth, SIEM for breadth.

Click to flip back

Question

Name the five main Defender XDR products and what each protects.

Click or press Enter to reveal answer

Answer

1) Defender for Office 365 — email and collaboration (phishing, malware). 2) Defender for Endpoint — devices (malware, ransomware, EDR). 3) Defender for Cloud Apps — SaaS applications (shadow IT, CASB). 4) Defender for Identity — on-prem Active Directory (lateral movement, reconnaissance). 5) Defender Vulnerability Management — continuous vulnerability discovery and prioritisation.

Click to flip back

Question

What is the Microsoft Defender portal?

Click or press Enter to reveal answer

Answer

The unified security portal at security.microsoft.com. It provides a single interface for incidents, alerts, hunting, Secure Score, threat analytics, and the action center across all Defender XDR products. Its key feature is the unified incident view — one incident correlating alerts from multiple products into a single attack story.

Click to flip back

Question

What is Defender for Cloud Apps?

Click or press Enter to reveal answer

Answer

Microsoft's Cloud Access Security Broker (CASB). It discovers shadow IT (unsanctioned cloud apps), monitors cloud app sessions for threats, enforces policies (like blocking downloads from unmanaged devices), and provides app governance. It protects both Microsoft and third-party SaaS applications.

Click to flip back

Knowledge check

Knowledge Check

SecureBank receives a phishing email targeting the finance team. One employee clicks the link and enters their password. The attacker then uses the stolen credentials to access a cloud file-sharing app and download financial data. Which Defender XDR capability ensures Alex sees the full attack chain — from phishing email to data exfiltration — in a single view?

ADefender for Office 365 Safe Links — it blocks the phishing URL at time of clickBThe unified incident view in the Defender portal — it correlates alerts from multiple products into one incidentCDefender for Endpoint automated investigation — it isolates the affected deviceDAdvanced Hunting — Alex writes a KQL query to search for the attack chain

Check Answer

Knowledge Check

Director Reyes asks: 'We already use Sentinel for our SIEM. Why do we also need Defender XDR?' Which response best explains the difference?

AYou don't — Defender XDR and Sentinel do the same thing. Pick one.BSentinel collects data from any source for broad visibility; Defender XDR provides deep, automatic cross-product correlation within the Microsoft ecosystem. Together they provide both breadth and depth.CSentinel is for on-premises monitoring; Defender XDR is for cloud monitoring only.DDefender XDR replaces Sentinel for organisations that use only Microsoft products.

Check Answer

Knowledge Check

James notices that employees at SecureBank are using several cloud applications that the IT department never approved — file sharing tools, project management apps, and AI assistants. Which Defender XDR product should Alex use to discover and govern these unsanctioned applications?

ADefender for Endpoint — it monitors all applications installed on company devicesBDefender for Identity — it tracks all authentication activity across the environmentCDefender for Cloud Apps — it provides shadow IT discovery and cloud app governanceDDefender Vulnerability Management — it scans for vulnerable software on devices

Check Answer