11.3 Common Threats Against Endpoints, Apps, and Identities
Key Takeaways
- Phishing, malicious links and attachments, and business email compromise are primarily addressed by Microsoft Defender for Office 365 (anti-phishing, Safe Links, Safe Attachments, impersonation protection)
- Malware and ransomware that execute on devices, and compromised endpoints, are primarily addressed by Microsoft Defender for Endpoint
- Identity compromise — password spray, brute force, stolen credentials, and on-premises directory attacks, with token theft as a related cloud-identity idea — is primarily addressed by Microsoft Defender for Identity, with Microsoft Entra ID Protection covering cloud sign-in and user risk
- Shadow IT and risky SaaS sessions are primarily addressed by Microsoft Defender for Cloud Apps, the CASB
- Real attacks cross those lanes; Microsoft Defender XDR correlates the email, device, identity, and app alerts into one incident so the SOC can see the full story
Quick Answer: Phishing, malicious links/attachments, and business email compromise → Defender for Office 365. Malware, ransomware, and compromised endpoints → Defender for Endpoint. Password spray, credential theft, and Active Directory attacks → Defender for Identity (cloud sign-in risk → Entra ID Protection). Shadow IT and risky SaaS sessions → Defender for Cloud Apps. When the same campaign uses more than one of those doors, Microsoft Defender XDR is the correlated incident.
The April 30, 2025 MS-900 outline asks you to describe how Microsoft 365 addresses the most common types of threats against endpoints, applications, and identities. Stay conceptual. You do not need MITRE technique numbers, unpublished breach statistics, or a click-path through Explorer. You need to recognize the threat in a one-paragraph story and name the primary Defender control. Then remember that sophisticated attacks rarely stay in one column — that is why the previous section’s XDR story exists.
Microsoft’s own Defender XDR overview uses almost this sequence: a phishing email steals or abuses an identity, the attacker lands on an endpoint, then moves toward apps and data. Your job is to know which product owns each hop and which product owns the whole path.
Map the common threats
| Threat | What it is on this exam | Primary Microsoft 365 control | Related helper |
|---|---|---|---|
| Phishing | A deceptive email, Teams message, or site that tricks a person into giving credentials or opening a payload | Defender for Office 365 anti-phishing; Safe Links | EOP anti-spoofing; attack simulation training (Plan 2) |
| Malicious links | URLs that lead to credential harvest or malware, including links that turn bad after delivery | Defender for Office 365 Safe Links (time-of-click) | Defender for Endpoint if the user still reaches a hostile site from the device |
| Malicious attachments / collaboration files | Weaponized Office files or executables in mail, OneDrive, SharePoint, or Teams | Defender for Office 365 Safe Attachments (detonation) | Defender for Endpoint if the file runs on a device |
| Business email compromise (BEC) | Impersonation of an executive, vendor, or trusted partner to request money or data — often no malware | Defender for Office 365 impersonation protection and mailbox intelligence | Entra MFA/Conditional Access so a stolen password is not enough |
| Malware / ransomware | Code that damages, steals, or encrypts; ransomware is the encrypt-and-extort flavor | Defender for Endpoint next-generation protection and EDR on the device | Safe Attachments if the payload arrived by email or in a cloud file |
| Compromised endpoint | A device the attacker already controls | Defender for Endpoint detect, isolate, automated investigation | Intune compliance/wipe is management aftermath, not the EDR detection |
| Identity compromise | Stolen or guessed credentials, including password spray and token theft conceptually | Defender for Identity (especially on-premises AD sensors); Entra ID Protection for cloud risk | Conditional Access and MFA (Chapter 10) reduce blast radius |
| Shadow IT / risky SaaS | Unsanctioned cloud apps, over-privileged OAuth apps, dangerous in-app sessions | Defender for Cloud Apps (CASB, app governance, session controls) | Sensitivity labels and DLP (later Purview chapter) once the app is known |
If two products could apply, pick the one that matches where the threat is happening right now. A ransomware email that has not been opened is still an Office 365 problem. Ransomware encrypting the disk is an endpoint problem. Both can appear in one XDR incident.
Threats against applications (email and SaaS)
Phishing is still the most common front door. The message looks like payroll, shipping, or IT. The goal is a password, a session, or a click. Defender for Office 365 scores impersonation, spoofing, and phishing confidence. Safe Links wraps URLs and checks them again at click time, which matters when a link is clean at delivery and weaponized an hour later. Built-in EOP already handles high-volume spam and known malware; Defender for Office 365 is the answer when the stem mentions phishing sophistication, Safe Links, or Safe Attachments.
Business email compromise is phishing’s quieter cousin. The attacker impersonates the CFO or a known vendor and asks finance to change a bank account. There may be no attachment and no malicious URL — just a convincing conversation. That is why impersonation protection and mailbox intelligence (does this person normally mail the CFO from that domain?) are the Office 365 features to name. Conditional Access and MFA still matter because many BEC paths start with a stolen mailbox, but the threat type on the exam is an email/collaboration impersonation problem first.
Malicious attachments are detonated in a virtual environment by Safe Attachments after the ordinary antivirus scan. The same engine can inspect files that land in SharePoint, OneDrive, and Teams, which is how Microsoft 365 addresses collaboration-borne malware, not only SMTP. Zero-hour auto purge is the cleanup story: a message that slipped through can be pulled back when new intelligence arrives.
Application on this outline also means SaaS. Employees adopt a file-sharing site that IT never approved (shadow IT). An OAuth app that a user consented to last year still has Mail.ReadWrite on thousands of mailboxes. A contractor downloads a customer list from a sanctioned CRM on an unmanaged home PC. Those are Defender for Cloud Apps stories: discover the app, score its risk, govern the OAuth grant, and — conceptually — apply a session control that blocks the download without banning the CRM. Do not send those stems to Defender for Cloud (Azure VMs) or to Intune Autopilot.
Threats against endpoints
Once code runs on a laptop, phone, or desktop, Microsoft Defender for Endpoint is the primary control. Malware is the broad term. Ransomware is the exam’s favorite subtype: encrypt files, demand payment. Defender for Endpoint’s next-generation protection aims to stop the payload; EDR aims to show the process tree and contain a device that is already sick. Attack surface reduction and vulnerability management shrink the chance the next exploit works. Automatic attack disruption in Defender XDR can isolate the device when confidence is high.
A compromised endpoint is the state after that success: the attacker has a foothold. The SOC’s product is still Defender for Endpoint (isolate, collect forensics, automated investigation). Intune can retire or wipe a corporate device and can feed compliance to Conditional Access so a known-bad device loses access to Exchange and SharePoint. That is complementary access control, not a substitute for EDR. Endpoint Analytics scores slow boots; it does not hunt ransomware.
Mobile devices are in scope: Defender for Endpoint includes mobile threat defense on Android and iOS, alongside Windows, macOS, and Linux. If the stem is “phones jailbroken or sideloading malware,” you are still in the endpoint pillar, often paired with Intune app protection from Chapter 7.
Threats against identities
Identities are the keys. Microsoft Defender for Identity’s own overview says attackers target users, applications, and service accounts to gain access, escalate, and persist. On MS-900, recognize these patterns:
Password spray tries a small set of common passwords against many accounts, slowly enough to dodge simple lockout. That is the opposite of classic brute force, which tries many passwords against one account. Both are identity-compromise techniques. Against on-premises Active Directory, Defender for Identity is the detection product (failed authentications, unusual patterns, reconnaissance that often comes first). Against Microsoft Entra ID cloud sign-ins, Microsoft Entra ID Protection flags risky users and risky sign-ins. Conditional Access can then require MFA or block the session. Do not call password spray “malware.”
Token theft (session-cookie or refresh-token theft) is the conceptual modern follow-on: the password was never guessed because the attacker reused a stolen sign-in token. Keep it high level. Entra ID Protection, Conditional Access session controls, and Continuous Access Evaluation are the identity-side mitigations; Defender for Cloud Apps session policies can add in-app monitoring. Defender for Identity remains the answer when the stem is Kerberos, NTLM, Golden Ticket, DCSync, or a sensor on a domain controller.
Lateral movement is how a low-privilege mailbox or help-desk account becomes domain admin. Defender for Identity maps those paths and raises the domain-dominance detections. XDR then ties the identity alerts to the device that ran the tool and the mailbox that received the original phish.
MFA, self-service password reset, and Conditional Access — already taught in Chapter 10 — are preventive identity controls. This section’s products are detective and responsive. A complete answer on a long scenario can mention both: MFA would have slowed the spray; Defender for Identity is what saw the spray.
How a realistic campaign uses every column
Walk this story once; the exam will shuffle the pieces.
- Finance receives a vendor invoice (phishing / malicious attachment). Defender for Office 365 should stop or detonate it. If a user still clicks, Safe Links is the second chance.
- The payload runs and starts encrypting (ransomware on an endpoint). Defender for Endpoint alerts and can isolate the laptop.
- The malware dumps credentials and the attacker password-sprays or forges tickets in Active Directory. Defender for Identity sensors raise reconnaissance and credential-abuse alerts.
- The attacker signs into a popular SaaS finance app from an unusual country and downloads records (app / session threat). Defender for Cloud Apps sees the anomalous session; a session policy could have blocked the download.
- Microsoft Defender XDR groups those four alerts as one incident in the Microsoft Defender portal, may automatically disrupt the account or device, and offers self-healing for the mailbox and endpoint.
If the question stops at step 1, the answer is Defender for Office 365. If it stops at step 2, Defender for Endpoint. If it asks how the SOC sees the whole chain, Defender XDR and the portal.
Realistic exam-style scenarios
Gift-card BEC. An email that looks like the CEO asks an assistant for $500 in cards. No link, no file. Defender for Office 365 impersonation / mailbox intelligence, plus user training. Not Defender for Endpoint.
Warehouse PCs encrypting overnight. Defender for Endpoint (and XDR disruption). Autopatch might have closed the vulnerability last month, but Autopatch is not the ransomware detector.
Many AD accounts, one password, 2 a.m. Password spray. Defender for Identity. Not Safe Attachments.
Marketing’s unsanctioned whiteboard SaaS. Shadow IT. Defender for Cloud Apps. Not Defender for Cloud.
User-reported phish that was already delivered. Investigate in the Defender portal; ZAP and Office 365 remediation pull remaining copies. Submitting the message to Microsoft is an Office 365 / portal action, not a Purview eDiscovery hold.
Stolen refresh token, no password prompt. Conceptual token theft. Entra ID Protection / Conditional Access / Cloud Apps session controls — not “reimage every laptop first.”
Exam traps
- Match the hop, then mention XDR only if the stem spans hops.
- BEC often has no malware. Impersonation is still an Office 365 threat.
- Password spray is an identity attack, not spam.
- Cloud Apps ≠ Cloud. Unsanctioned SaaS is Cloud Apps.
- Intune does not replace Defender for Endpoint for ransomware on a managed PC.
- Compliance Manager and Secure Score do not “block the phish.” They measure posture; Defender products enforce and detect.
- EOP is the baseline; Safe Links / Safe Attachments / impersonation are Defender for Office 365.
- Stay conceptual: you do not need unpublished incident counts or actor names.
Official sources
- What is Microsoft Defender XDR? — coordinated protection across email, endpoints, identities, and apps; malicious-file sharing example
- Why do I need Microsoft Defender for Office 365? — phishing, malware, BEC, Safe Links, Safe Attachments, ZAP
- Microsoft Defender for Endpoint — device threats, EDR, ransomware-oriented next-generation protection
- Microsoft Defender for Identity overview — reconnaissance, compromised credentials, lateral movement, domain dominance
- Microsoft Defender for Cloud Apps overview — shadow IT, session/threat protection, OAuth app governance
- Describe threat protection with Microsoft Defender XDR — suite-level threat narrative used in fundamentals training
- Study guide for Exam MS-900 — common threats against endpoints, applications, and identities
Users receive spoofed invoice messages that point to a credential-harvesting website. Which Microsoft 365 product is the primary control for that email and URL phishing path?
Several managed Windows laptops begin encrypting files after a user opened a payload. Which product is the primary control for malware and ransomware on those endpoints?
Security telemetry shows many failed sign-ins against many on-premises Active Directory accounts using a short list of common passwords — a password spray. Which product is designed to detect that identity-compromise pattern?
Finance receives a message that appears to come from the CFO and asks for an urgent wire transfer. There is no attachment and no URL. Which Defender capability is the primary email and collaboration control for that business email compromise pattern?