11.1 Microsoft Defender XDR Family and Defender Portal

Quick Answer: Microsoft Defender XDR stitches alerts from Defender for Endpoint (devices), Defender for Office 365 (email, URLs, Teams/SharePoint/OneDrive), Defender for Identity (Active Directory and identity sensors), and Defender for Cloud Apps (SaaS/CASB) into one incident. Security teams work that story in the Microsoft Defender portal at security.microsoft.com. Microsoft Defender for Cloud is Azure workload protection — it is not Defender for Cloud Apps.

The April 30, 2025 MS-900 outline asks you to describe Microsoft Defender XDR, Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps, and the Microsoft Defender Portal. This is a matching skill. You will not be asked to write a Kusto hunting query, size a Plan 2 license, or click every node in the portal. You will be asked which product watches laptops, which one detonates a suspicious invoice attachment, which one uses sensors on domain controllers, which one finds unsanctioned SaaS, which layer correlates those alerts into one attack, and which website is the unified console.

Microsoft Learn’s current definition is the scoring key: Microsoft Defender XDR is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications. Older materials still say Microsoft 365 Defender. On this exam treat those names as the same suite. The suite is more than four separate consoles. When one workload finds a malicious file, it can tell the others to block that file on sight. Related alerts become one incident. Analysts hunt across about 30 days of historic raw signals from the licensed Defender products.

The matching table (exam favorite)

Memorize this table before anything else. Most MS-900 threat items are a one-line scenario plus one of these names.

Two names that do not belong in that matching table as synonyms:

• Microsoft Defender for Cloud protects Azure and other cloud workloads (virtual machines, containers, databases, cloud security posture). It can send signals into the same portal, but it is not Defender for Cloud Apps. If the stem says “unsanctioned SaaS” or “CASB,” the answer is Cloud Apps.
• Microsoft Defender Antivirus is the built-in Windows malware engine. Defender for Endpoint is the enterprise endpoint platform that includes next-generation protection, EDR, attack-surface reduction, and automated investigation. “Which product is the XDR endpoint pillar?” is Defender for Endpoint, not “Windows has an antivirus.”

Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is the enterprise endpoint security platform. Official Learn: it helps organizations prevent, detect, investigate, and respond to advanced threats on endpoints, including laptops, phones, tablets, PCs, and related network devices. Supported client families you should be able to name are Windows, macOS, Linux, Android, and iOS.

Capabilities that matter at fundamentals level are next-generation protection (including ransomware-oriented malware blocking), endpoint detection and response (EDR), attack surface reduction, vulnerability management, automated investigation, and feeding device alerts into Defender XDR. A security team can isolate a device, collect investigation packages, and see the process tree that dropped the payload.

Pair it with the last chapter so you do not collide the two device products. Microsoft Intune enrolls the device, pushes configuration, and reports compliance to Microsoft Entra ID for Conditional Access. Defender for Endpoint tells you the device is under attack and helps contain the malware. A laptop can be Intune-compliant and still need Defender for Endpoint when ransomware starts encrypting files. Conversely, Defender for Endpoint does not replace Autopilot or Autopatch.

Microsoft Defender for Office 365

Microsoft Defender for Office 365 safeguards the organization against malicious threats in email messages, links (URLs), and collaboration tools. That last phrase is the exam expander: protection is not only Exchange Online. Safe Attachments can detonate files in SharePoint, OneDrive, and Teams. Safe Links rewrites and time-of-click checks URLs in mail, Office clients, and Teams.

Every Microsoft 365 tenant with cloud mailboxes already has Exchange Online Protection (EOP) — the built-in anti-malware, anti-spam, and basic anti-spoofing layer. Defender for Office 365 sits on that ladder. Plan 1 adds impersonation protection, Safe Attachments, and Safe Links. Plan 2 adds investigation, hunting, attack simulation training, and automated investigation and response (AIR). MS-900 will not ask you to reciting every Plan 2 tile. It will ask which product is the answer when the threat arrived as a phishing email, a malicious URL, a BEC impersonation, or a bad file in OneDrive.

Zero-hour auto purge (ZAP) is the “we already delivered it, then we learned it was bad” control. After a message lands, the service can pull phishing, spam, or malware back out of mailboxes. That is still Defender for Office 365 / EOP email security, not Defender for Endpoint.

Microsoft Defender for Identity

Microsoft Defender for Identity is a cloud security service that monitors identity signals from on-premises Active Directory and, in the current product, Microsoft Entra ID and other identity providers. The architecture fact MS-900 still loves is the sensor: lightweight sensors run on identity infrastructure (typically domain controllers and related AD roles), parse relevant network traffic and Windows events locally, and send the needed signals to the cloud service. You do not stand up a separate on-premises SIEM to get those detections.

Detections follow the identity attack chain that Microsoft publishes:

• Reconnaissance — enumerating users, groups, or resources
• Compromised credentials — brute force, repeated failures, suspicious group changes
• Lateral movement — expanding control toward privileged identities
• Active Directory domain dominance — DCShadow, malicious replication, Golden Ticket-style activity

Microsoft Entra ID Protection sits next to this product, not instead of it. Entra ID Protection scores cloud sign-in and user risk (leaked credentials, anonymous IP, atypical travel). Defender for Identity is the answer when the stem emphasizes on-premises AD, sensors, Kerberos/NTLM attacks, or lateral movement inside the directory. Chapter 10 already covered MFA and Conditional Access; this chapter’s identity product is the threat detection sensor, not the access policy engine.

Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps is Microsoft’s cloud access security broker (CASB) and the SaaS pillar of Defender XDR. Official Learn groups its job into four ideas you should be able to paraphrase:

1. Fundamental CASB — discover shadow IT, rank apps, see who uses which cloud service on and off the corporate network.
2. SaaS Security Posture Management (SSPM) — flag risky app configurations and push those recommendations into Microsoft Secure Score.
3. Threat protection / XDR — user and entity behavior analytics on connected apps; malware in cloud storage; correlation into Defender incidents.
4. App governance — watch OAuth apps that already have permission to a user’s mail or files.

Session controls are conceptual on this exam. Combined with Conditional Access App Control, Cloud Apps can monitor or limit what happens inside a cloud-app session — for example, block download of a sensitive file to an unmanaged device without banning the whole app. If the stem is “we do not know which SaaS apps marketing is using” or “control a session in Salesforce/Box,” pick Cloud Apps. If the stem is “protect the Azure virtual machine,” pick Defender for Cloud, not Cloud Apps.

Microsoft Defender XDR as the correlation layer

The individual products still do their jobs if you never say “XDR.” What Microsoft Defender XDR adds is the cross-product layer. Official capabilities to name:

• Combined incidents queue. Related alerts, evidence, and impacted assets from email, devices, identities, and apps become one incident instead of four tickets.
• Automatic attack disruption. High-confidence signals from more than one workload trigger containment — isolate a device, disable a compromised account — without waiting for a human to stitch the story.
• Self-healing. Automated playbooks try to return mailboxes, endpoints, and identities to a known-good state.
• Cross-product hunting. Analysts query raw signals across the licensed Defender products from one place.
• Signal sharing. Microsoft’s own example: a malicious file found by Defender for Endpoint can instruct Defender for Office 365 to scan and remove that file from email, and the suite blocks it on sight.

You only get correlation from products the tenant has licensed and provisioned. The portal hides tiles the subscription does not include. That is why “we bought E3, why is Threat Explorer missing?” is a licensing conversation, not a portal outage.

The Microsoft Defender portal

The Microsoft Defender portal at https://security.microsoft.com is the single pane of glass. It is not a sixth Defender SKU. It is where Defender XDR, and other security solutions you have turned on, surface:

• Incidents and alerts — the prioritized attack stories
• Hunting — custom detections and advanced hunting queries
• Actions and submissions — review automated actions; submit a file, URL, or message to Microsoft
• Threat analytics — Microsoft researcher reports on active actors, ransomware families, and vulnerabilities
• Secure Score — posture, covered in the next section

Email & collaboration tools (Explorer or Real-time detections, quarantine, attack simulation) live under that portal’s navigation when Defender for Office 365 is licensed. Identity alerts from Defender for Identity appear in the same incident queue rather than only in a legacy standalone console.

MS-900 does not test the March 2027 Microsoft Sentinel-in-Azure retirement. If a question mentions Sentinel at all, treat the Defender portal as the direction of travel for unified security operations — and stay focused on XDR incidents, not SIEM workspace design.

Realistic exam-style scenarios

Phish then ransomware. A user clicks a payroll link, a payload runs on the laptop, then the same identity probes a domain controller. Defender XDR is why that is one incident. The email piece is Defender for Office 365, the device piece is Defender for Endpoint, the directory piece is Defender for Identity. Do not pick Intune; Intune did not “catch the attack.”

Unknown SaaS. The CISO asks which unsanctioned file-sharing apps contractors use from home. Defender for Cloud Apps cloud discovery / shadow IT. Not Defender for Cloud, and not the SharePoint admin center.

Domain controller sensor. “We need detections for Golden Ticket and reconnaissance against on-premises Active Directory.” Deploy Defender for Identity sensors. Entra ID Protection alone does not parse DC traffic.

Weaponized OneDrive file. A shared Excel file in a Teams channel detonates as malware. Defender for Office 365 Safe Attachments for SharePoint, OneDrive, and Teams — not Defender for Endpoint first, because the file has not yet executed on a device.

Where do we work the queue? The SOC lives in the Microsoft Defender portal (security.microsoft.com), not the Microsoft 365 admin center and not the Intune admin center.

Exam traps

• Cloud Apps ≠ Cloud. CASB and shadow IT are Defender for Cloud Apps. Azure VM and container protection are Defender for Cloud.
• XDR is not a device agent. The agent/sensor lives in the child products. XDR is the correlation and portal experience.
• Intune is management; Defender for Endpoint is threat protection. Enrollment, compliance, and Autopilot are Intune. EDR and ransomware on the device are Defender for Endpoint.
• EOP is not the full Office 365 answer. Baseline anti-spam is EOP. Safe Links, Safe Attachments, and impersonation are Defender for Office 365.
• Entra ID Protection is not Defender for Identity. Cloud user/sign-in risk versus AD sensors and identity attack-path detections.
• The portal is not Purview. eDiscovery, DLP policy authoring, and Compliance Manager live in Microsoft Purview. Incidents and hunting live in the Defender portal.
• Former name. Microsoft 365 Defender and Defender XDR are the same suite family on this outline.

Official sources

• What is Microsoft Defender XDR? — suite definition, child products, incidents, hunting, self-healing
• Microsoft Defender XDR in the Microsoft Defender portal — security.microsoft.com; incidents, hunting, actions, threat analytics
• Microsoft Defender for Endpoint — device pillar, platforms, EDR
• Why do I need Microsoft Defender for Office 365? — email, URLs, collaboration; EOP versus Plan 1/Plan 2
• Microsoft Defender for Identity overview — sensors, AD signals, attack stages
• Microsoft Defender for Cloud Apps overview — CASB, shadow IT, SSPM, session/app governance
• Describe threat protection with Microsoft Defender XDR — SC-900/MS-900-aligned service descriptions
• Study guide for Exam MS-900 — Defender family skill (last measured April 30, 2025)