Microsoft Defender XDR
Microsoft Defender XDR is the extended detection and response layer over Microsoft's Defender services. It joins alerts from endpoints, email, identities and cloud apps into single incidents in the Defender portal, supports hunting across that data and can contain an attack automatically while it is still running.1
Also known as Microsoft Defender Suite, Microsoft Defender, Defender XDR
- Intended for
- Security operations (SOC) analysts, Security and IT administrators, CISOs choosing a Microsoft 365 security bundle
- Runs on
- Microsoft cloud service managed in the Microsoft Defender portal, Devices onboarded to Defender for Endpoint, On-premises Active Directory through Defender for Identity sensors, Cloud workloads through Defender for Cloud, SaaS apps through Defender for Cloud Apps
At a glance
- What is it?
- Microsoft Defender XDR is a suite of pre- and post-breach protection services tied together by a shared cross-product layer. The services include Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, Defender Vulnerability Management and Defender for Cloud, and the layer also takes signals from Microsoft Entra ID Protection, Microsoft Purview Data Loss Prevention and Insider Risk Management, App Governance and Microsoft Security Exposure Management. It correlates only the products a tenant has licensed and provisioned. Microsoft Learn calls the platform Microsoft Defender XDR, while the microsoft.com product page sells the bundle as Microsoft Defender Suite.12
- What does it do?
- It groups related alerts, affected assets and automated actions into one incident queue, so analysts can see how an attack entered and what it touched. Automatic attack disruption uses high-confidence, cross-workload correlation to contain compromised devices, users, IP addresses and OAuth apps during an attack, and the security team can undo every automatic action. Self-healing uses automated remediation to bring mailboxes, endpoints and identities back to a safe state. Advanced hunting gives query access to 30 days of raw signals and alerts from the endpoint, email, identity and cloud app services. Security Copilot agents, such as the Threat Intelligence Briefing Agent and the Security Analyst Agent, run inside the Defender portal.134
- Who needs it?
- Organizations that already license several Microsoft security services, for example through Microsoft 365 E5 or Microsoft 365 E3 with the Defender Suite add-on, and want one place to triage and respond. Security operations teams that are short of analysts gain most from correlated incidents and automatic containment. Smaller firms reach the same portal through Microsoft 365 Business Premium or Microsoft Defender for Business.5
- What does it need?45
- A qualifying license, such as Microsoft 365 E5 or A5, Microsoft 365 E3 with the Defender Suite or EMS E5 add-on, Microsoft 365 Business Premium, Defender for Business, or a standalone Defender service
- At least the Security Administrator role in Microsoft Entra ID to turn on the service
- Microsoft Defender for Endpoint Plan 2 for automatic attack disruption and threat analytics
- Devices onboarded to Defender for Endpoint, and Defender for Identity sensors on domain controllers for on-premises identity actions
- A Security Copilot workspace with SCU capacity to deploy Security Copilot agents from Security Store
- What it is not
- Defender XDR is not a SIEM: it correlates signals from the Microsoft security products you license, while Microsoft Sentinel collects and analyzes logs from Microsoft and non-Microsoft sources. It is not a single antivirus product either; Defender for Endpoint is one of several components. Automatic attack disruption does not replace incident response: Microsoft positions it as a way to contain an attack and leave the security team in control of investigation and recovery, and it requires Defender for Endpoint Plan 2.36
Availability and licensing. Checked 26 Oct 2026: Microsoft lists Microsoft Defender Suite at $12.00 per user per month on an annual subscription, with Microsoft 365 E3 (or Office 365 E3 with EMS E3) as a prerequisite. Defender XDR features also come at no extra cost with Microsoft 365 E5 or A5, EMS E5, Microsoft 365 Business Premium, Defender for Business and standalone Defender services. ISOC is in preview. Defender for Office 365 integration is not available in the Norway, South Africa, UAE, Sweden and Singapore data center locations.25
The problem it solves
Attacks rarely stay in one system. A phishing email leads to a stolen identity, the identity is used on a device, and the attacker moves sideways from there. When email, endpoint, identity and SaaS security sit in separate consoles, analysts have to rebuild that story by hand while the attack continues.
Defender XDR joins the signals from those services into incidents and acts across them. Microsoft's example: when Defender for Endpoint finds a malicious file on a device, Defender for Office 365 is told to scan for it and remove it from every mailbox.1
How it works
Each Defender service collects its own telemetry: sensors on devices for Defender for Endpoint, mail flow for Defender for Office 365, Active Directory signals for Defender for Identity and SaaS activity for Defender for Cloud Apps. The cross-product layer in the Microsoft Defender portal (security.microsoft.com) joins alerts, suspicious events and affected assets into incidents.
- Incidents: one queue that groups the alerts, assets and automated actions of an attack.
- Automatic attack disruption: correlates high-confidence signals, identifies the assets the attacker controls and applies containment such as contain device, contain user, disable user or revoke sessions. Microsoft states that it keeps a confidence level of 99% or higher for containment actions, measured on its production data.
- Predictive shielding: preventive hardening, such as blocking Group Policy abuse or Safe Mode tampering, and proactive containment of users that prediction logic rates as high risk.
- Advanced hunting: custom queries over 30 days of raw data.
Attack disruption can also act in Okta and AWS IAM through Microsoft Sentinel connectors; both are in preview. The Integrated Security Operations Center (ISOC), also in preview, adds SIEM features such as case management, workbooks and natural-language playbook generation to the Defender portal for eligible customers that have no Sentinel workspace.37
Diagram as a list
Copilot & business apps
- Microsoft Defender portalIncident queue, hunting and response consoleConnects to Cross-product XDR layer
Agents & automation
- Security Copilot agentsAlert triage, threat intelligence briefings and hunting helpConnects to Microsoft Defender portal
Data & analytics
- Microsoft Sentinel connectorsBring non-Microsoft data and enable Okta and AWS disruption actions (preview)
Security, identity & governance
- Cross-product XDR layerCorrelates alerts into incidents and runs automatic attack disruption
- Defender for EndpointDevice protection, detection and containment
- Defender for Office 365Email and collaboration protection
- Defender for IdentityUses on-premises Active Directory signals and can disable usersConnects to Microsoft Entra ID and ID Protection
- Defender for Cloud AppsSaaS app visibility and actions on OAuth apps
- Microsoft Entra ID and ID ProtectionIdentity risk signals; sessions revoked and users suspended during disruption
Capabilities
Correlated incidents1
Alerts, affected assets and automated actions from the licensed Defender services are grouped into one incident queue in the Defender portal.
Why it matters: Analysts work through one attack story instead of many separate alerts.
Limits: Only signals from products you have licensed and provisioned are correlated.
Automatic attack disruption3
Contains devices, IP addresses and users, disables or suspends accounts, revokes sessions and acts on compromised OAuth apps when an attack is detected with high confidence.
Why it matters: Limits lateral movement and remote encryption before an analyst can react.
Limits: Requires Defender for Endpoint Plan 2; Okta and AWS IAM actions are in preview; set exclusions for critical users, devices and IP addresses.
Predictive shielding3
Preventive actions such as Safeboot hardening, GPO hardening and proactive containment of users flagged as high risk by prediction logic.
Why it matters: Blocks common attacker techniques before an incident escalates.
Limits: Predictive user containment blocks new sessions but does not end existing ones.
Cross-product threat hunting18
Custom queries over 30 days of raw signals and alerts from Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps.
Why it matters: Finds signs of compromise that no alert caught.
Limits: Longer history needs another store, for example the Microsoft Sentinel data lake, which keeps Defender XDR data for up to 12 years.
Security Copilot agents in Defender4
The Security Alert Triage Agent (preview, an extension of the Phishing Triage Agent), Threat Intelligence Briefing Agent, Threat Hunting Assistant, Security Analyst Agent and Dynamic Threat Detection Agent run in the Defender portal.
Why it matters: Automates alert triage, threat briefings and hunting queries.
Limits: Needs Security Copilot capacity (SCUs); some agents need more licenses, such as Defender for Office 365 Plan 2 for email alert triage.
Integrated SIEM features (ISOC, preview)7
Case management, workbooks, enhanced automation rules and natural-language playbook generation in the Defender portal, plus an optional ISOC workspace for UEBA, threat intelligence and third-party data.
Why it matters: Gives Defender Suite, Microsoft 365 E5 and E7 customers SIEM functions without deploying a SIEM first.
Limits: Preview; only for customers without an active Microsoft Sentinel workspace; 30 days of included Defender data retention during the preview; extra ingestion can add charges.
Practical use cases
Phishing leads to stolen accounts and ransomware moving between devices faster than the SOC can respond.
- Approach
- License Defender for Endpoint Plan 2, Defender for Office 365 and Defender for Identity, and configure automatic attack disruption with exclusions for critical assets.
- Role of Microsoft Defender XDR
- Defender correlates the signals and contains compromised users and devices while the attack runs.
- Data, infrastructure and skills
- Defender for Endpoint Plan 2, onboarded devices and the Security Administrator role.
- Type of benefit
- Faster containment
- Caveats
- Automatic actions can affect legitimate users; keep exclusions current and undo actions when needed.
- First step
- Review the attack disruption settings and add exclusions for critical accounts and servers.
Analysts spend much of their day triaging user-reported phishing.
- Approach
- Deploy the Phishing Triage Agent, or the Security Alert Triage Agent for preview participants, from Security Copilot in the Defender portal.
- Role of Microsoft Defender XDR
- The agent classifies alerts, explains its verdict and learns from analyst feedback.
- Data, infrastructure and skills
- Security Copilot capacity and Defender for Office 365 Plan 2.
- Type of benefit
- Analyst time saved
- Caveats
- Triage of cloud and identity alerts is in preview; analysts should keep reviewing verdicts.
- First step
- Set up the agent with a dedicated agent identity and review its verdicts during a pilot period.
A Microsoft 365 E5 customer wants SIEM-style case management without deploying a separate SIEM.
- Approach
- Use ISOC in the Defender portal and add an ISOC workspace later for third-party data and UEBA.
- Role of Microsoft Defender XDR
- Defender provides XDR plus built-in SIEM features in one portal.
- Data, infrastructure and skills
- Defender Suite, Microsoft 365 E5 or E7, no active Sentinel workspace, and an Azure subscription for workspace features.
- Type of benefit
- Lower setup effort
- Caveats
- ISOC is in preview, so capabilities and availability can change; ingesting more data can add charges.
- First step
- Check the ISOC banner on the Defender portal home page to confirm eligibility.
Who uses it
Make-A-Wish America (national office and chapters)
In productionMake-A-Wish America: unified data, Copilot and an IT help bot
roughly two-thirds of staff (measured)
Nonprofit, United States
Works with
Optional integration
- Microsoft SentinelSentinel runs in the Defender portal, and Sentinel connectors enable Okta and AWS disruption actions (preview).
- Microsoft Security CopilotSecurity Copilot agents are deployed and run in the Defender portal.
- Microsoft EntraDefender uses Entra ID Protection signals and can revoke sessions or suspend users in Entra ID.
- Microsoft PurviewDefender takes signals from Purview Data Loss Prevention and Insider Risk Management.
Complementary tools
- Microsoft IntuneIntune combines Defender risk signals with device compliance for Conditional Access.
Optional integration for
- Microsoft Security CopilotEmbedded in the Defender portal, with agents for alert triage, threat intelligence and hunting.
- Microsoft SentinelSentinel runs in the Defender portal, and Defender XDR alerts and incidents are free data sources.
- Microsoft Agent 365Defender adds threat detection and runtime protection for agents.
- Microsoft IntuneDefender supplies endpoint security signals and vulnerability data used by Intune and its agents.
- Microsoft EntraDefender XDR uses Entra ID Protection signals and can revoke sessions or suspend users in Entra ID.
- Microsoft 365 E7E5 base includes full Defender XDR; Microsoft adds advanced Defender capabilities in E7.
- Microsoft PurviewInsider Risk Management insights flow into Defender XDR.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Compared with
Getting started
Confirm licenses
In the Microsoft 365 admin center, open Billing > Licenses and look for Microsoft 365 E5, E3 with Defender Suite, Business Premium or standalone Defender services.
Check: A qualifying license is listed; viewing it needs the Billing admin role or higher.
Turn on Defender XDR
Sign in at security.microsoft.com with at least the Security Administrator role and turn on the service.
Check: The incident queue and advanced hunting open in the Defender portal.
Onboard signal sources
Onboard devices to Defender for Endpoint and install Defender for Identity sensors on domain controllers.
Check: Devices and identities appear as assets in new incidents and in hunting results.
Configure attack disruption
Review automated response settings and add exclusions for critical users, devices or IP addresses.
Check: Incidents where disruption acted show an Attack Disruption tag and a yellow banner.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Defender XDR or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- What is Microsoft Defender XDR? (opens in a new tab)
- Microsoft Defender Suite product page (opens in a new tab)
- Automatic attack disruption in Microsoft Defender (Microsoft Learn) (opens in a new tab)
- Deploy AI agents in Microsoft Defender (Microsoft Learn) (opens in a new tab)
- Microsoft Defender XDR prerequisites (Microsoft Learn) (opens in a new tab)
- What is Microsoft Sentinel SIEM? (opens in a new tab)
- Integrated Security Operations Center (ISOC) in Microsoft Defender (opens in a new tab)
- Microsoft Sentinel data lake overview (Microsoft Learn) (opens in a new tab)
- What is Microsoft Intune? (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.