Microsoft Defender XDR Reviews

I use Microsoft Sentinel for monitoring cybersecurity threats as it is a SIM tool from Microsoft. Additionally, Microsoft Defender XDR provides security across multiple layers, deploying Defender for Endpoint on devices like laptops and desktops, Defender for Identity for Active Directory monitoring, and Defender for Office 365 for email security.

I find Microsoft Sentinel easier to configure since there is no need to manage all underlying components. Microsoft Defender XDR is effective for containment when threats occur, allowing for isolation of the host or account disabling. Although automation capabilities are better with Microsoft Sentinel, Microsoft Defender XDR shows potential. Integration with other Microsoft products is seamless, making it easier to create a unified security posture.

For Microsoft Defender XDR, there is currently no ability to reset passwords for on-premises accounts, which is a key challenge. Incident management can be difficult if third-party ITSM tools are connected with XDR. Initial tech support is slow in understanding problems. Improved integration with third-party ITSM solutions and enhanced automation in XDR would be beneficial.

I have been working with Microsoft Defender XDR for more than five years.

The deployment of Microsoft Defender XDR was not difficult. It is straightforward, and activating it involves just a couple of clicks.

I find Microsoft Defender XDR to be stable now.

Microsoft Defender XDR is definitely scalable.

The initial level of tech support is slow and rated as six out of ten. However, once issues are escalated to the second or third layer, the support is much better.

For POC purposes, I have worked with CrowdStrike and Trellix XDR. However, I used Microsoft Defender XDR due to pre-existing Microsoft products in our ecosystem, ensuring seamless integration.

The initial setup of Microsoft Defender XDR is easy. It involves enabling the system with a few clicks and then tuning it as needed. I wanted to leverage Microsoft products across all security areas for better compatibility.

I have seen an ROI in terms of efficiency. Previously, identifying and containing threats took a long time, but now, with Microsoft Defender XDR, it takes just a few minutes.

The pricing for Microsoft Sentinel operates on a pay-as-you-go model based on data ingestion. I recall that Defender XDR pricing is based on the number of endpoints.

I evaluated CrowdStrike and Trellix XDR during the POC stage.

Based on my experience, I rate Microsoft Defender XDR as nine out of ten. If you are utilizing Microsoft in-house products for different security postures, go with Microsoft Defender XDR as it is easier to manage and scalable. It is notably the most compatible option if your organization already uses Microsoft products.

We use the entire 365 security package. Defender XDR is primarily used for real-time malware scanning. Our company has about 1,500 endpoints. 

Before Defender, we used a different tool but were unhappy with its performance and frustrated with the deployment. Defender offers real-time scanning and alert notifications.

By adopting the Microsoft stack, we have eliminated other security solutions. Defender XDR reduces manual work. Our organization manages more than 1,500 systems, and manual intervention on all these systems would be a huge workload. Cloud solutions are easier to manage and monitor. 

We are a massive Microsoft shop. We see significant savings by getting all of our security from one vendor. There is a considerable drop compared to buying from other vendors. 

Defender XDR enables you to scan a system remotely and get a complete inventory of its assets. You can gather more information from the asset inventory and apply threat intelligence using Office 365 or something. It's a user-friendly, cost-effective, and feature-rich solution. The XDR features offer considerable value because you get more insights from your user systems.

Microsoft Defender XDR stops the movement of advanced attacks by working with the complete 365 package. For example, you can create rules for email filtering to block phishing emails. I can create rules for email filtering. If there are any suspicious links in an email or its attachments, we can quarantine that email. It notifies the admin or the user.  The user can ask the admin to remove the email from the quarantine. We can investigate the email before it reaches the endpoint. Defender also has web content filtering and all the other EDR file features.

Defender's ability to adapt to evolving threats is critical today. The number of attacks today is multiplying, and Defender's adaptability and awareness are amazing.

The initial time spent setting up and configuring Defender XDR is a bit longer than the other solutions. If everything were on one portal, the platforms for managing policies or alerts would be simpler. We must automate and manage policies on Intune rather than the same portal.

I have used Microsoft Defender XDR for nearly 14 months.

I am very satisfied with Defender's stability. It's a reliable solution that improves our confidence in our security.

I rate Microsoft support seven out of 10. I would like Microsoft's support to be a little more robust and technical.

Neutral

Deploying Defender XDR is pretty straightforward. We deployed it in phases with deadlines. It took a couple of months. We met all our deadlines, and it wasn't a very complex solution to implement. 

We prepared and configured the tenant. Next, we created XDR policies and groups and orchestrated our requirements. We tried pushing the policies to see if the endpoints received them and sent the required information back to the admin portal. There was a testing period before we went live. Deployment only required two people. 

Defender doesn't require much maintenance after deployment because it's a cloud-based solution. We only need to tweak and update the policies, then push them out. 

Defender XDR is reasonably priced based on the licenses we need and the solution's capabilities. At the same time, Defender is a little pricier than some of the other solutions. 

We also considered CrowdStrike and Trend Micro. Trend Micro came the closest to meeting our expectations. Ultimately, we decided to use Defender XDR because we already used most of the Microsoft products, so it was a little more cost-effective. 

I rate Microsoft Defender XDR nine out of 10. Before deploying Defender XDR, potential users should be informed about the pricing, support, and the labor required to manage, maintain, and deploy the solutions. 

I work for a managed security service provider, where a dedicated team at our Security Operations Center manages the entire 365 Security Stack for our clients. This means we're constantly monitoring alerts, prioritizing incidents, and responding actively, leveraging automation features where possible. We also play a crucial role in the onboarding process, setting up and integrating security solutions with our platforms for efficient alert management and incident response. Furthermore, we handle policy configuration and hardening, ensuring effective security controls are in place. We actively maintain these policies, fine-tune them as needed, and adapt them to new features and updates, collaborating closely with clients throughout the process. In essence, we own and manage the security platform for our clients, providing them with comprehensive protection and peace of mind.

Microsoft Defender XDR is working towards a unified identity and access management system. While currently, separate role-based access controls exist for different Defender XDR components, a major challenge is that some solutions remain tenant or subscription-based. However, Microsoft has a migration plan in place to address this. We can currently utilize both centralized and individual RBAC models, though it's important to note that the centralized approach is still under development and may not be as user-friendly as the individual models. Nonetheless, the centralized model offers fine-grained control over access permissions, which can be beneficial for organizations with specific requirements or concerns. For instance, we can grant or deny specific analysts the ability to automate remediation or isolation events or to modify security settings. While the level of detail can be overwhelming for those unfamiliar with granular access control lists, it ultimately provides powerful capabilities for managing access to Defender XDR. Overall, Microsoft is actively working to centralize all IAM under a single portal, demonstrating a commitment to improving user experience and access control.

Microsoft Defender offers two main identity protection solutions. Defender for Identity: This is their on-premise Active Directory security solution. It's essential for organizations with on-premise identities and helps analyze specific events within our local Active Directory. Microsoft has been investing heavily in this product, and it has improved significantly in the past year. The second is Microsoft Entra Identity, formerly Azure Active Directory Identity Protection: This is a cloud-based service ideal for organizations with cloud identities in the Office 365 ecosystem. It's almost a mandatory service if we want strong security controls for our open and centrally accessible platform. It excels with risk-based security settings, conditional access policies, and risk-based situations based on device type, compliance, location, and more. It's one of the best solutions within Microsoft 365 SAC due to its ease of implementation, rapid risk reduction, and extensive security features.

Microsoft Defender for Cloud's security reach extends beyond just Microsoft technologies. It analyzes data from various cloud platforms, including AWS and GCP, not just Microsoft Azure. This data feeds into the centralized 365 XDR dashboard, bringing together telemetry, alerts, and advanced features like AI, machine learning, and KQL query support for hunting threats. Defender for Cloud acts as a gateway to this broader security, integrating with individual solutions like app protection for Zoom, Dropbox, and ShareFile. These protected applications generate alerts and data that also flow into the 365 XDR dashboard, providing a unified view of our security posture.

The effectiveness of detecting lateral movement depends on the specific solutions in place and their proper configuration. I have a background in penetration testing, so I've witnessed this firsthand in various environments. Microsoft Defender for Endpoint, an EDR solution, offers a strong chance of preventing initial access, suspicious commands, and remote code execution. This, in turn, helps hinder lateral movement at its earliest stages. It also detects suspicious activity originating from external sources and even alerts on potentially compromised devices that aren't yet onboarded. Microsoft Defender has made significant advancements, providing both active monitoring and passive detection capabilities. For lateral movement specifically involving domain accounts, Defender for Identity, an Active Directory monitoring solution, is adept at detecting similar attacks. These include extracting golden tickets, keys, DCSync attacks, and more. Notably, recent advancements in October introduced artificial intelligence and machine learning capabilities to detect hands-on keyboard threat attacks. This feature is remarkably effective. In my most recent engagement, I successfully identified a known attacker who had compromised a high-profile account and promptly contained that user account. Containment restricts the account's ability to connect to external services. For instance, if the attacker logs in as that user, they're unable to access file shares, Outlook, or other services. This level of protection is challenging to achieve in today's complex organizational environments, as general detection methods often fall short. Behavioral analysis is crucial, and Microsoft has invested heavily in developing these capabilities within its solutions.

Defender's core strength against attacks lies in its ability to adapt to ever-changing threats. Specifically for endpoints, Defender Endpoint serves as the main defense line. It analyzes a wealth of data, beginning with endpoint detection and response through the Defender for Endpoint solution. This solution identifies suspicious activity, generates alerts, and analyzes them. Certain criteria, undisclosed by Microsoft, trigger incident creation when the likelihood of a real threat is high. Properly configured, these incidents automatically trigger investigations, replicating manual SOC analyst work. Investigation packages are collected, analyzing network connections, files, processes, and real-time entities for suspicious activity. Processes can be automatically executed or terminated, quarantined, and files isolated. Continuous monitoring persists until the investigation concludes and is marked as resolved. Additionally, Microsoft Defender continuously searches for and investigates potentially impacted devices related to the original incident, adapting its response as the situation evolves.

Many organizations are replacing their EDR solutions with Microsoft Defender, or upgrading from paid antivirus solutions. While I won't mention specific vendors, consider a common antivirus platform costing two to ten dollars per month for basic protection. We recommend leveraging the free Windows Defender Antivirus included with supported operating systems and adding an EDR solution. Defender Endpoint works seamlessly with native Windows Defender Antivirus, being embedded in the Windows TCP/IP stack, making it an excellent pairing. However, in most cases, both are still desirable. Generally, Defender for Endpoint catches 90 percent of threats, while antivirus covers specific signatures. Defender has made significant strides in endpoint security, so there's no need to underestimate its capabilities. The built-in Defender Antivirus offers many valuable features, and Defender for EDR further enhances them. Although numerous EDR players exist, and individual assessments are crucial, I find Defender for Endpoint very intuitive with excellent incident management. It also boasts a significantly shorter learning curve compared to other EDR solutions I've used.

I'm not utilizing Microsoft Defender XDR in the traditional sense for my organization. Primarily, it's our clients who are using it. It's a bit of a mixed bag. Some clients choose to use the solution even though it might be more expensive, but they gain enhanced protection for their investment. Others can reduce costs because they were previously overpaying for separate EDR solutions, antivirus platforms, and cloud monitoring tools without enjoying their full benefits. For these clients, leveraging the included features within their licensed package proves advantageous. It's fantastic that organizations with the E5 or E5 Security add-ons have access to these powerful features, often without even realizing it. We help bring them to light and enable clients to get them up and running effectively. So, in that sense, they're gaining significant protection and technically saving money.

The centralized dashboard is a huge time saver for several reasons. Previously, each security solution had its dashboard, making it tedious and time-consuming to jump between them and remember all the different URLs. Onboarding new team members was also a hassle, requiring me to curate a list of all the necessary URLs. Combining everything into a single unified dashboard eliminates these issues. Consolidating alerts into distinct categories (alerts and incidents) is another significant advantage. Simply dumping all alerts into one view is ineffective, as many organizations have discovered. Categorization saves valuable time by making it easier to identify and prioritize critical issues. Furthermore, the automated investigation capabilities of XDR in Defender for Endpoint offer significant time savings from an operational perspective. Features like user containment, device auto-quarantine, and native incident investigation workflows streamline the process of reviewing, analyzing, and responding to alerts. Additionally, the ability to collect investigation packages further expedites the incident response process. 

From the perspective of Microsoft 365 XDR, the main benefit is a single, centralized dashboard offering the holistic visibility organizations crave. This is particularly valuable when dealing with multiple vendors, as fragmentation can make achieving this visibility difficult. Microsoft 365 Defender shines when deployed within organizations heavily invested in the Microsoft ecosystem. For those heavily reliant on Defender products like Defender for Endpoint, Defender for Office, and now even Microsoft Sentinel, 365 Defender provides that coveted single-pane-of-glass view, eliminating the need to jump between different dashboards. This centralized view is the key attraction of 365 XDR for organizations already heavily invested in Microsoft tools.

Overall, the unified dashboard is a great step forward. However, for new users unfamiliar with Microsoft and these products, it can be overwhelming. The abundance of sub-dashboards and sub-areas within the main dashboard can be confusing, even if it all technically makes sense. While it's great for our technical teams and C-Suite to have access to a centralized risk dashboard, it needs to be simplified for less tech-savvy users. The numerous dashboards and interfaces, despite being unified, can be daunting for new users. Ideally, Microsoft could streamline the interface and consolidate information to improve accessibility. When incidents occur, the action center for response actions can be unclear, especially for users unfamiliar with the platform. It can be difficult to find out where, when, and how remediation actions took place. A more intuitive and transparent action center would be helpful.

I've been using Microsoft Defender XDR for four years now. Microsoft has consistently changed the naming, initially using individual dashboards before centralizing everything.

Microsoft Defender is stable. In the time I have been using 365 Defender, we have had only one major case.

Microsoft Defender scales well, especially when considering the specific solutions we choose. Bringing everything into Unified View makes managing this scalability much easier. We've deployed the 365 Defender suite across clients of all sizes, and it consistently demonstrates strong scalability, thanks in part to its low maintenance requirements. This minimal management overhead also contributes to overall scalability.

The technical support quality depends on our support package. If we have standard support, it isn't always the best, but if we have premier support and we pay for that support, it is a lot better. So, again, it goes into the support package, and who we get on the end, I can say they will assign someone pretty quickly and just depends on when they get back to us, kinda how complex our situation is. I don't have as much issue with Microsoft support, but we have premier support.

Neutral

Microsoft could improve the onboarding process for Defender for Endpoint. While the current approach involves deploying a package, I'd prefer more control from the cloud. Ideally, onboarding and offboarding could be managed directly from the console, eliminating the need for additional policy management solutions. While there's no one-size-fits-all solution, Defender for Endpoint's onboarding isn't entirely straightforward. Implementing strong security practices remains crucial, and leveraging existing OS security features is essential. However, some crucial policy settings must be enabled through local policy group policies or Intune, rather than directly from the Defender console. This lack of centralized management, unlike say Microsoft 365 Defender, creates an inconsistency in policy application.

The deployment requires me and one IT admin.

We are the integrator, so we build and implement Microsoft Defender XDR for our clients.

Microsoft Defender XDR is included in our license.

I would rate Microsoft Defender XDR an eight out of ten. It excels in its core functionalities, although there are some areas for improvement. Overall, it's a robust security stack that stands out among its competitors.

Microsoft 365 Defender is more than just a name, it's a comprehensive suite of security solutions. However, the specific services included depend on the licensed SKU purchased by an organization. From a security perspective, having identity and email security is crucial, but ultimately the decision depends on the organization's risk tolerance and budget. Microsoft 365 XDR, a newer name introduced by Microsoft, isn't a separate product, but rather a high-level dashboard that provides an overview of our organization's deployed Microsoft security solutions.

It's difficult to directly compare 365 Defender, a software suite, to XDR, a unified platform for extended detection and response. While organizations could build their central unified view or even find other vendors offering similar solutions, integrating seamlessly with existing infrastructures would be a significant effort. This puts Microsoft in a strong position to provide a unified view, making XDR stand out in this regard. While platforms like SOAR share some similarities in terms of user integration, they don't quite match the comprehensiveness of Microsoft's XDR platform.

Microsoft Defender primarily consists of Software as a Service offering, meaning cloud-based services with minimal hardware maintenance required. Think of it like an online application we access and use, instead of something we install and maintain on our own. Updates to the Defender engine, specifically the Defender for Endpoint Engine, are seamlessly delivered through Windows updates. The other solutions within Defender also require minimal maintenance. Defender for Identity might occasionally suggest health checks to perform, sometimes generating alerts about outdated sensors or new security recommendations from Microsoft, e.g., disabling TLS 1.1. These alerts might arrive via email and often simply require updating sensors to the latest version. However, the specific maintenance needs depend on the individual solution we're using within the Microsoft 365 Defender suite. Overall, we can expect maintenance to be very minimal.

Before diving into new security solutions, take some time to understand your specific needs. Research what areas require the most protection and prioritize accordingly. If you have existing solutions that need replacing, Microsoft offers several options that can seamlessly integrate. However, if you're simply looking to bolster your security posture, there's no need to go all-in at once. Microsoft makes it easy to gradually expand your service offerings and incorporate new security packages. It's worth checking your current license queue, as you may already have access to some of these solutions under your existing Microsoft cloud subscription. Most organizations have some level of Microsoft presence, so depending on your specific SKU, you might already be eligible for these solutions. So, do your research and focus on the areas that require the most immediate attention. Remember, you don't need to jump into everything at once, as Microsoft offers a comprehensive suite of security solutions accessible through the 365 dashboard.

Private Cloud

Microsoft Azure

The primary use case involves using Microsoft Defender XDR as a comprehensive security solution. This includes securing endpoints, user devices, SQL databases, containers, and third-party cloud solutions such as AWS and Google Cloud.

Microsoft Defender XDR is a complete package of different Defender solutions, including Defender for Endpoint, Defender for Office 365, Defender for Cloud, and Sentinel SIEM, among others. With Microsoft threat intelligence information, it detects various types of threats, including insider attacks, malicious content, and data exfiltration.

There is no comprehensive visibility, making it less user-friendly. The visibility of different types of threats should be improved. This aspect is not as developed compared to third-party vendors. Improvements are needed in automated response capabilities.

I have been working with Defender XDR for around two years now.

I would rate the stability of the solution as seven out of ten due to compatibility issues across different devices.

The scalability would also be rated as seven out of ten. It is suitable for enterprise-level deployment but has room for improvement.

For technical support, I would definitely give a rating of nine out of ten.

Positive

The setup process is simple; enabling features just requires the right licenses and is essentially an on-off switch on the portal.

I would rate the pricing as eight out of ten, indicating it is a reasonable cost for the product.

Overall, I would give Defender XDR an eight out of ten. While it is a good enterprise solution, there is room for improvement in different areas.

Microsoft Defender XDR is our antivirus solution.

Microsoft Defender XDR provides a unified identity and access management platform.

It does a good job with identity protection.

Including identity and access management within Defender XDR is valuable because it streamlines our organization's security by consolidating multiple tools into one. This eliminates the need to manage and pay for separate solutions and licenses, simplifying our security posture.

Microsoft Defender XDR has improved our visibility, making us more efficient by providing threat details and remediation steps as well as improving our security posture.

It safeguards our organization by preventing advanced threats like ransomware and business email compromise, along with stopping lateral movement within our network that could enable attackers to spread and gain wider access.

It includes the ability to stop attacks and adapt to evolving threats. This is an important feature for us.

We have been enabled to discontinue using Microsoft Sentinel.

Microsoft Defender XDR helps save costs through the licensing for businesses which is around $20 each and helps save time for our security team.

The ability to isolate and address viruses is the most valuable feature of Microsoft Defender XDR.

Just like in any solution, the price can always be cheaper.

I have been using Microsoft Defender XDR for three months.

Microsoft Defender XDR is stable. It has been running smoothly for us.

The support has been perfect.

Positive

To consolidate our security tools and avoid additional costs for a separate EDR solution, we leveraged our existing Microsoft Sentinel license to migrate to Microsoft Defender XDR, which already includes EDR capabilities.

Our initial deployment of Defender XDR onto machines was simple. Onboarding a machine involves configuring settings within Intune for our tenant, allowing Defender XDR to communicate and collect data. The entire deployment process took only two hours and required just one person.

The implementation was completed in-house.

I would rate Microsoft Defender XDR ten out of ten.

No maintenance is required.

I recommend Microsoft Defender XDR for small businesses like ours.

Public Cloud

Microsoft Azure

Microsoft Defender XDR is used as an additional layer of protection we moved to Microsoft 365. It helps protect both our cloud infrastructure and endpoints.

We conduct regular phishing tests and have seen a decline in breaches because our users pay more attention to what's coming into their inboxes. We've seen fewer incidents.

The email protection feature is the most valuable because our risks primarily lie there, and it seems to be the most popular target. 

Sometimes, digging into the information and knowing where to go can be difficult. It would be better if much of that information were immediately visible, especially when looking at endpoints or users.

I have used Microsoft Defender XDR for around four years now.

The stability has been great. I haven't noticed many issues.

Regarding scalability, we're not a very large organization, with about three hundred people worldwide, so it has worked for us so far.

I rate Microsoft customer service seven out of 10. I have been able to get the help I need, but I know other technicians have had difficulty getting support.

Neutral

Previously, we had on-prem solutions and used Cisco Firepower as our main security. The pandemic accelerated our switch to Microsoft Defender XDR in 2020, as Skype for Business was going away, leaving Teams as the only option and leading us to look more to the cloud.

Moving all our mailboxes up to the cloud was pretty seamless. There weren't many hiccups, so I thought it went well.

We worked with Softchoice to initially get the ball rolling. They had someone come in to guide us through the steps.

On my side, it's difficult to speak about the return on investment, but we've improved our security posture.

I rate Microsoft Defender XDR an eight out of 10. It functions well for our needs and has not presented many performance issues. It's easy to take action, and we have not found many pain points.

Hybrid Cloud

Other

We have it deployed as part of our security stack for our endpoints.

The technicians working on the issues have a clearer idea of a higher priority issue versus a lower priority. 

I like that Defender is easy to use and the alerts are all in one central location.

Some of our older hardware experienced a slight bump in CPU and memory usage. Although I don't have empirical data to back that up, I would suggest possibly more streamlining in the software.

I have been using Defender XDR for seven months.

We haven't had any issues with it, so I don't have any problems with its stability.

From what I have seen, it's easy to roll out to new onboarded machines and servers.

Microsoft support is not very good. You get stuck in low-level support for way longer than you should, instead of them escalating the issue up the chain. This is kind of the same with all Microsoft support, not just XDR.

Positive

We had BitDefender EDR, which is a pretty similar product, but we switched because we were trying to put everything under the Microsoft umbrella. We got good pricing on it and were happy with the results of the testing we did. Defender XDR officers richer insights into Defender XDR. It's a better overall experience. 

I don't personally crunch those numbers, so I don't know. But I know that we're committed to this for the future, so I would assume that we're doing okay.

Defender XDR is priced comparably to other solutions on the market.

I would rate Defender XDR as an eight or a nine. There is always room for improvement.

We provide MXDR services. Initially, they are professional services such as setup and deployment, and then after that, we provide Day 2 services, which include working on the incidents and alerts the products generate, determining which one is a true positive and which one is a false positive, taking response actions, and maintaining a steady state.

We are expanding use cases with Defender for IoT integration. Now that the E5 license includes the enterprise IoT sensors, we are getting more of that telemetry to our SOC. Because most SOCs do not have that telemetry, it is something that we have had a couple of clients invest in. 

In terms of our in-house usage of this solution, there is not a lot of in-house infrastructure when it comes to workstations and things like that. As a security company, we are pretty infrastructure-light.

It helps with the well-rounded investigation where it does the automated investigations and does a lot of enrichment for you, so the SOC analyst does not have to play run and go fetch as much. They can go deeper into an investigation in a shorter amount of time.

It does not necessarily provide unified identity and access management. Most of that comes from Entra ID, but it absolutely provides security visibility. For identity protection, the combination of Azure Identity Protection and Defender for Identity in the same place is the most powerful part because it is your on-prem identity world and your cloud identity world. Those two things are connected in most environments. Most of the people who have issues or most Microsoft customers have hybrid environments. That means they have two IMs and a bidirectional trust. One is the old-school one, which is Active Directory, and that lets everybody in with a username and password, whether you are good or bad, and then the newer one is the one that has conditional access, and that is Entra ID. Most corporate environments have both, so you have all of the weaknesses of both systems in one nice little package. From a defensive monitoring standpoint, we get a lot of cases, and most clients have that situation. Most clients that we see for incident response, and who are dealing with whether they are going to have our business online tomorrow, are in that hybrid situation.

In terms of covering more than just Microsoft technologies, most of 365 Defender is focused on its own technologies. There is that extensibility to be able to bring in threat indicators. The Zeek integration in Windows provides a lot of functionality, but most of the time, when we are getting that third-party signal, it is via a SIEM. That is where we go look for that third-party cross-correlation signal. The XDR signal is in that 365 Defender portal, and using things like custom detections is helpful there, so you can do SIEM-like functionality, but not on a third-party data set. This third-party correlation is the logical place for Sentinel. Some of the federated search between the two and being able to see both datasets in both places relieves that pain. The vast majority of our MDR clients are using 365 Defender and Sentinel, but there are definitely people who have E5 licensing but still have QRadar, Splunk, or something like that. Sometimes, we have somebody who starts with just 365 Defender but has a Sentinel adoption plan because they have a year left on their QRadar contract. The cool part about Sentinel is that it is software as a service, so you can start small and then add to it. You can start with what we call Sentinel Light, which is basically just the free data connectors. A lot of times what people do is that they have E5 licensing in their contract, and they start with 365 Defender. They then start with free data sources in Sentinel and incrementally add server logs or Palo Alto logs as their budget allows them.

365 Defender has enabled us to discontinue the use of other security products. There is always realization in terms of whether we still need, for example, Tenable agents with 365 Defender TVM. The answer is probably not. Normally, it is building out that process where we are going to remove Tanium because we now have Intune, so everybody has that adoption roadmap. Typically, you go for the things that create the least amount of friction when you are going through that adoption roadmap and you save the things that are going to be painful, such as DLP, for the end. It is always about dollars. When it comes to security budgets, potentially, you are replacing five to six line items on your security budget with one. I have been getting extra functionality on top of it for Teams and things like that. When you make the business case to the decision-makers and you get all of the information at the table, it is normally a pretty overwhelming case.

The savings depend on what their actual spending is and how many other security vendors they are purchasing. For most information security professionals, half of their day goes into vendor meetings and maintaining those vendor relationships. You have active relationships, contract relationships, etc. You have all these different relationships, and you have to go out to their conferences, their dinners, and things like that, so you end up dealing with vendors all day instead of actually doing the work. There are two types of costs. There is that hard cost, which is pretty easy to define, and there is also that soft cost of what if you had this common security fabric that you could take, customize, and then add to it. That is what the Microsoft security play is. Instead of bolt-on security, it is built-in security, and then you can still add to it. You can still add custom tools like Velociraptor and all the other tools that complement the Microsoft security suite, but what you do not have to do is play with vendors all day and do the bolt-on security play, which is, "Install our agent and everything will be good. There will be 99% ransomware protection." That is not how real life works.

It saves time and brings operational efficiency. As threat hunters, looking for an initial compromised assessment, going into a SIEM, and looking through a SIEM can take a lot of time. With 365 Defender, I can run four or five queries on you, and if they light up, I know you have problems. If they do not light up, you are probably alright. It is about being able to get there relatively quickly and assess the situation. Should we go ahead and send out the notice and call the general counsel, or is this just a little thing we need to run down and keep traps on? The time saved depends on where they are coming from. If it is a relatively old school company that has got an old school SIEM, and then they have a next-gen antivirus and a separate EDR solution, they could be doing 100% manual investigation, so it is saving them 300% because the chances are that they were not even investigating all their alerts. 

The ability to hunt that IM data set or the identity data set at the same time is valuable. As incident response professionals, we are very used to EDRs and having device process registry telemetry, but a lot of times, we do not have that identity data right there with us, so we have to go search for it in some other silo. Being able to cross-correlate via both datasets at the same time is something that we can only do in Defender 365. We do not get it in the other products.

From an integration standpoint, it is always improving overall. With Security Copilot coming out, as partners, we are waiting for the GDAP support so that we can actually see Security Copilot on behalf of customers if they subscribe to it. I assume that will happen in the next couple of months, but there have been smaller improvements like that. I started with the Defender ATP product back in 2019. In terms of where it started versus where it is now, it is very different. A lot of the automated defense capabilities for auto-remediation and the threat and vulnerability management features that are coming out are the most exciting because they answer that CISO question, which is, "How covered am I for ransomware?" Most of the time when people answer that question, it is a very generic answer. They can look at the top twenty methods that most ransomware groups are going to use to see how protected they are, but they are probably not going to do that well, or they are pretty secure, and they are probably going to do pretty well. It gives more of that real-world experience that most people do not have. 

We have been using this solution for about four and a half years.

From a partner standpoint, typically, we do our best not to contact support. We are very sensitive about how we spend our time. The more time we burn on something, the less profitable we are. Normally, playing kick-the-ticket-around in any support organization does not help, so most of the time, our engineers can arrive at some type of solution without engaging anybody else. If we do have a hard blocker that is well-defined and well-documented, we typically escalate that through the product team and not through the support channel because the more time we spend on the phone with support, the less we believe in our overall relationship, so we just avoid that activity, and we feel good about the relationship.

We definitely have had some major instances with large customers where something bad was happening and they needed immediate resolution, but they did not even get a callback for 48 hours. When you are in the middle of that relationship just doing the SOC servers, you wonder why you are getting 300 attack alerts in an hour. You then escalate and call everybody inside of Microsoft. You blow up the horn right on Friday because these things always happen on Fridays. It is a bad situation for everyone. The one thing that I have learned especially with MDE is that most of the time, the people who can fix your issues are in Tel Aviv. A lot of times, if I put an entire well-documented explanation together and drop it in Teams to somebody, I will get a response at 2 AM, so the next day, I will check my messages first thing, and a lot of times, it is like, "That issue is fixed now." I know where I need to go when I need to get things solved, but calling any help desk, including our own internal help desk, does not work. 

In the right context, Microsoft's support can easily be a seven or an eight out of ten adventure. In the wrong context, it can easily be a two or three adventure. It is like rolling the dice. Sometimes they come up with snake eyes, so it is all about expectations.

I also deal with Azure a lot because most of the time, I am responsible for our backend systems. We are rebuilding our entire platform in Azure. We did a greenfield build, so I am teaching a lot of Java developers on Azure. Their default answer when something does not work is that Azure is broken. I know that Azure is not broken. They are doing it wrong. I then show them, but their general thought is, "Why don't we just open a ticket with Azure support?" My response is, "Why do you want to wait three hours for them to tell you the same thing, which is, that you are doing it wrong?" A lot of it is engineers learning. If they have the appropriate exposure and investment in education, it helps with digital transformation, but it also helps with security transformation. A lot of times organizations buy things and then tell their engineers to implement them. Nobody bothered to send them into training first, so they are doing their best with the information they have. They did not send them to Microsoft Ignite. They did not send them to any of the great local resources. We have all these different meetup groups where you can see the difference in people. You get to know who is succeeding with Azure or succeeding with Microsoft Security. When you get stuck, you know whom to call and ask how to do something because you are not able to figure it out even after wasting six hours. You can ask them to at least point you in the right direction. That is a better solution than calling an 1800 number because it is going to be more focused and more prescriptive.

We support a couple of other security vendors as well, which always gives us a great comparison to how they are doing. It is the difference between holistic security and non-holistic security. You get one set of data. It could be a good set of data, but it is not mixed with the other data points. When you got an email alert here, and then you got an identity alert, and then you got an EDR alert, and then you got the domain controller alert, you can go through that entire kill chain versus those separate technologies. With separate technologies, you are going to spend an hour and a half putting that story together, and chances are they are already on ten different servers by now, so you are behind the gun. You know the story, but now, you have a bigger story because it just blossomed over there.

In terms of comparison, there are quite a few other XDR products, and all of the XDR products suffer from the same kind of challenge, which is—they are only as good as the data they have available. For instance, if you are a 365 Defender shop, but you are using Okta, a lot of that identity information is not flowing through 365 Defender. It is flowing through Okta, so it is 60% to 70% blind. Trend Micro has its XDR solution, but if you do not have all the things deployed, and you only have 30% of the things deployed, you are looking at 30% percent of the data. That is one of the key components. When we deal with an IR situation, we have a lot of people who are like, "We have E5. We deployed Defender for Identity. We deployed Defender for Endpoint to some of the endpoints, but not all of these servers yet because that is scheduled for next year." In such scenarios, we have limited visibility. We can see certain things, but those other alerts tell us some other things are going on on some endpoints that we cannot see. That is the situation that you have to solve rather quickly, so halfway-done deployments are the issue. When we see them, we know why they are calling us because it was always bound to happen. It is then that classic situation where they will have to do it all in two days on Saturday and Sunday. They will have to completely redo it and finish off that deployment because this is what they needed to do for threat eradication.

I have helped clients deploy it. I have helped a little bit with the internal deployment. We do not have that much infrastructure. Most of our infrastructure is containers, and 365 Defender does not come into play. That is mostly the Defender for Cloud Storage.

In terms of the time it normally takes for different users to get fully deployed and functional with the solution depends on the users and the infrastructure. Those are two different things. For humans, typically those enablement sessions can go in a matter of weeks, and then it is also a matter of the client investing some of their own time in their own lab and things like that because you are never going to learn a tool unless you get hands-on with it. Watching me work on it is not going to teach you that much. You have to work on it, and then because Microsoft security is a holistic security and not a bolt-on thing, you are also dealing with some tech debt at the same time. If they have had 2012 servers and they have not updated those servers in eight years and there are no security patches, you will have to resolve some of those dependencies before you can onboard those servers to Defender. It is not Defender's fault. They should have been patching those all the way anyway. That is according to the best practices, but they were not, so now you will have to wait three weeks for the server team to update these and then you onboard them to Defender. Every corporation has different change controls. If it is a small corporation with only four or five thousand endpoints, there are probably three or four guys who can pretty much do whatever they need to do. A big corporation with a hundred thousand endpoints will have to put that through change control and then four people have to sign off in blood. It is a much bigger thing and lots of paperwork has to happen.

Normally, a good accelerator project takes three to four weeks. That includes going through the basics, making a deployment plan, doing a test group, and then validating that all of those policies are going to work in the environment. One of the big advantages that changed just in the last year is the built-in configuration management. When I initially started with 365 Defender about four or five years ago, we had a problem where a lot of people would run the onboarding packages but forget to deploy the policy, so it did not work as well as it could. The difference those other platforms had was that they had built-in policy management, so you make your settings and apply them to your group of endpoints, but now, it is there in Defender. Previously, with Defender, we had nine different ways to do it, such as configuration manager, registry, and PowerShell, and clients struggled with that because none of the options were perfect for all their endpoints. With the built-in configuration management, you have that feature parity now. You can do built-in policy management for Windows, Mac, and Linux endpoints, and that speeds up deployments. As the deployment engineer, you do not have to say, "Here is the list of ten different options. Let us select which one is going to work for which group of devices." Now you can just say, "We have a good solution. It is probably going to work for about 99% percent of your devices. You might have a few offline servers or old Linux servers. We will have to do a slightly different custom solution for them, but we have a 99% solution. Let us go ahead and get started on it," and that is very good because you do not necessarily lose the room when you are explaining it to your security team members who never had to do something like that. You can just say, "We have a solution here, guys. We are good."

When we go through all of the information security training, typically, we are trained on other systems, so there is a learning curve for most information security professionals. If there is executive sponsorship to say, "We are going to invest in learning our Microsoft security tools so that we get maximum bang for our buck out of them," that typically goes very well. Microsoft has programs, such as accelerators and the ESIS programs, that enable partners to guide that mission. 

Our deployment engineers have done the Sentinel and 365 Defender deployments for four or five years. They work on these projects all day and every day. A lot of time, they are just helping other people who are doing their first project and saying, "Oh, you probably do not want to load it on these servers.", or "This is the shortcut for this issue." They are just guiding them on that process and helping them avoid some of the mishaps and things that people normally struggle with. Once you get them fully deployed, the ROI starts showing up daily. It is just a matter of getting them to that steady state versus that halfway-done state because a halfway-prepared defense never performs well in combat.

I would rate 365 Defender a nine out of ten. It is a very powerful tool. My favorite gig is explaining it to other incident response professionals and saying, "Now that the customer has an E5 license, and this is all deployed, let me show you this. You run this query, and you bring all of this stuff back. This is how you create custom detections that will automatically isolate things if anything jumps off on this device." I can explain that in a two-hour crash course. If you can explain it the right way to other professionals, they end up realizing how powerful it is. It works great.