01
The Microsoft Defender Ecosystem
Microsoft Defender is not a single product — it's a family of integrated security products that cover endpoints, email, identity, cloud apps, and cloud infrastructure. Together they form Microsoft Defender XDR: Extended Detection and Response — a unified security platform.
| Product | Protects | Included In |
|---|
| Defender for Endpoint | Laptops, desktops, servers | Business Premium, E3+MDE addon |
| Defender for Office 365 | Email, Teams, SharePoint links | Business Premium, E3+MDO addon |
| Defender for Identity | Active Directory and Entra ID | Business Premium, E5 |
| Defender for Cloud Apps | SaaS applications | Business Premium, E5 |
| Defender for Cloud | Azure workloads | Separate Azure subscription |
Microsoft 365 Business Premium includes Defender for Endpoint, Office 365 Plan 1, and Defender for Cloud Apps. For most SMBs this is the highest-value licence bundle available.
Core capabilities
✓Endpoint Detection and Response (EDR) — behavioural detection of attack techniques, not just malware signatures
✓Automated Investigation and Remediation (AIR) — automatically investigates and contains threats without manual intervention
✓Attack Surface Reduction (ASR) rules — block specific attacker techniques at the OS level
✓Threat and Vulnerability Management — continuous inventory of vulnerabilities on enrolled devices
✓Device isolation — remotely isolate a compromised device from the network with a single click
Deployment
✓Onboard via Microsoft Intune — policy-based deployment, no agent installation required
✓Applicable to Windows, macOS, iOS, and Android
✓Tamper protection — prevents attackers from disabling Defender after compromise
✓Alert visibility in Microsoft 365 Defender portal (security.microsoft.com)
03
Defender for Office 365
Plan 1 (Business Premium)
✓Safe Links — real-time URL detonation at click-time, including links in Teams and Office documents
✓Safe Attachments — detonate attachments in a cloud sandbox before delivery
✓Anti-phishing with impersonation protection — protect specific users (CEO, CFO) from spoof attempts
✓Spoof intelligence — identify and block email spoofing
Plan 2 (E5 or addon)
✓Attack Simulator — send simulated phishing emails to staff, measure click rates
✓Threat Explorer — investigate and hunt for threats across all email in your tenancy
✓Automated investigation and response — automatically investigate and contain email-based threats
✓Priority account protection — enhanced protection for VIP users
Safe Links time-of-click protection catches attacks that traditional secure email gateways miss: links that are clean at delivery but weaponised before the user clicks.
Defender for Identity protects Active Directory and Entra ID from identity-based attacks — credential theft, lateral movement, privilege escalation, and persistence techniques.
What it detects
✓Pass-the-Hash and Pass-the-Ticket credential theft
✓Kerberoasting — offline cracking of service account credentials
✓DCSync attacks — simulating domain controller replication to dump password hashes
✓Suspicious lateral movement — using credentials on machines the user normally doesn't access
✓Reconnaissance activities — enumeration of domain users, groups, and admin accounts
✓New suspicious admin account creation
Deployment
✓Install sensor on all domain controllers (on-premise AD)
✓Entra ID integration — cloud identity signals automatically included
✓Alerts surface in Microsoft 365 Defender portal as part of unified incident view
05
Defender for Cloud Apps
Defender for Cloud Apps provides visibility into which SaaS applications are in use across your organisation — including apps you haven't approved — and controls over how corporate data is used in those apps.
Key capabilities
✓Shadow IT discovery — identify all cloud apps in use from browser or network logs
✓App governance — assess risk rating of each app, block or restrict high-risk apps
✓Session policies — control what users can do in cloud apps (download, print, copy) from unmanaged devices
✓File scanning — scan files in SharePoint, OneDrive, Box, Google Drive for sensitive data
✓Anomaly detection — alert on impossible travel, mass download, suspicious admin activity
Most businesses are using 50–150 SaaS applications they haven't formally approved. Defender for Cloud Apps identifies them and assesses risk — you may find employees using file sharing services that violate your data handling policy.
06
Microsoft 365 Defender Portal: Unified Investigations
The Microsoft 365 Defender portal (security.microsoft.com) correlates alerts across all Defender products into unified incidents — so a phishing email, the credential it stole, the lateral movement that followed, and the endpoint it landed on all appear as a single incident.
✓Incident queue — prioritised view of all active incidents across all Defender products
✓Automated investigation graph — visual representation of the attack chain with automated remediation actions
✓Advanced Hunting — query across all security data using KQL for threat hunting
✓Threat analytics — Microsoft intelligence reports on active attack campaigns relevant to your configuration
✓Secure Score — aggregate posture metric across identity, devices, data, apps, and infrastructure
De4sec monitors the Microsoft 365 Defender portal as part of our managed security service — reviewing incidents, triaging alerts, and responding to threats on behalf of clients.
