2.2.3. Microsoft Defender XDR
š” First Principle: Microsoft Defender XDR (Extended Detection and Response) is a unified threat protection platform that correlates signals across endpoints, email, identity, and cloud apps to detect and respond to attacks that individual point solutions would miss. It's the difference between having five separate smoke detectors and having a fire alarm system that knows which rooms are connected.
A single security product watching only email might catch a phishing email. But if the same attacker also compromises a device, moves laterally, and exfiltrates data through a cloud app ā and those are three separate products with no visibility into each other ā the attack succeeds. XDR correlates those signals into one incident.
Microsoft Defender XDR is made up of several integrated products:
| Defender Product | What It Protects | Key Capability |
|---|---|---|
| Defender for Endpoint | Windows, Mac, Linux, iOS, Android devices | Threat detection, EDR, vulnerability management |
| Defender for Office 365 | Email (Exchange Online), Teams, SharePoint links | Safe Links, Safe Attachments, anti-phishing |
| Defender for Identity | On-premises Active Directory + Entra ID | Detects identity-based attacks (pass-the-hash, lateral movement) |
| Defender for Cloud Apps | SaaS applications (Salesforce, Box, etc.) | Shadow IT discovery, session control, anomaly detection |
| Defender Vulnerability Management | Devices and software | Identifies and prioritizes security weaknesses |
All of these feed into the unified Microsoft Defender portal at security.microsoft.com, where security teams investigate incidents, run threat hunting queries, and manage automated response actions.
š” Key Point: For AB-900, you don't need deep technical knowledge of each Defender product. You need to know what each one protects ā matching a threat scenario to the right Defender product is the typical question format.
ā ļø Exam Trap: Defender for Office 365 protects email content and links ā it is not the same as Exchange Online. Exchange manages mailbox objects; Defender for Office 365 scans the content flowing through those mailboxes for threats.
Reflection Question: A user clicks a malicious link in an email that downloads malware to their laptop, which then tries to log into your on-premises Active Directory with stolen credentials. Which two Defender products are most relevant to detecting and responding to this attack?
