Microsoft 365 Defender: The Big Picture

In this chapter, we will explore the four core services that build up Microsoft 365 Defender and how they unify into an extended detection and response (XDR) platform to improve and simplify your proactive and reactive security capabilities:

• Microsoft Defender for Endpoint
• Microsoft Defender for Office 365
• Microsoft Defender for Identity
• Microsoft Defender for Cloud Apps

You will learn the purpose and capabilities of each across endpoints, communication platforms, hybrid identity, and cloud applications and infrastructure.

After learning about them individually, you’ll then see how they come together in the Microsoft 365 Defender XDR platform to provide a centralized solution for preventing, investigating, and responding to threats.

This will paint a complete picture of the comprehensive capability set in Microsoft 365 Defender before later chapters dive into how you deploy and use those capabilities. If...

Microsoft Defender for Endpoint

As we look at the four core services of Microsoft 365 Defender, MDE stands as the biggest in terms of its scope and ambition. It shares the same Defender branding as the consumer antivirus built into Windows 10/11, but it is much more.

Endpoint protection evolves into extended detection and response

To understand MDE, you need to understand the evolution of operating system antimalware. In this section, we will have a brief history lesson so you can understand the what, why, and how of MDE.

In the beginning

In the beginning, we had, by today’s standards, relatively basic software that tried to block, quarantine, delete, or clean based on file signatures. The vendor maintained their database of known malware with a hash of that malware, and your device would act if it found a file with that same hash. This signature approach can be called traditional protection.

As processing power, threat intelligence, and cloud capabilities improved...

Microsoft Defender for Identity

MDI exists to protect organizations’ hybrid identities and is an evolution of Advanced Threat Analytics (ATA). Unlike ATA, MDI is a cloud-first service, abstracting away much of the overhead infrastructure requirements administrators face. In this section, we will explore the problems MDI fights against and how it does so.

The rise and risks of Active Directory

In enterprise IT, on-premises AD is still ubiquitous. First released in Windows 2000 Server, AD Domain Services (AD DS) soon established dominance over its competitors as the go-to directory service for organizations of any scale. With Microsoft’s interests and focus shifting towards Azure, Microsoft 365, and cloud resources, on-premises AD has not seen much development for the last decade, though it is still a supported platform. The trend is towards Azure Active Directory (Azure AD), Intune, and other cloud services; however, most organizations, particularly those at scale...

Microsoft Defender for Office 365

Email security has been the bane of cybersecurity for decades. It remains one of the most common ways for attackers to distribute inbound malware, but the problem goes much deeper than looking for malicious files. Using phishing and business email compromise (BEC) attacks, an email can tick all the boxes in terms of being malware-free, domain name system (DNS) authenticated, and reputation-check clean, but still result in a successful offense.

In Microsoft 365 environments, Exchange Online Protection (EOP) is the default protective gateway and security layer that email must pass. It is available for Exchange Online mailboxes but can support hybrid Exchange environments and can be licensed to on-premises mail servers, even if they are not Exchange Servers. At its core, EOP protects against emails that fail checks against reputation, DNS authentication, malware, spam, phishing, and grey/bulk mail.

With such a long list of the types of threats covered...

Microsoft Defender for Cloud Apps

The direction of travel is clear: apps and services and moving to the cloud. This can be seen in the widespread adoption of Software-as-a-Service (SaaS) such as Microsoft 365, Salesforce, Slack, and Google Workplace, and Platform-as-a-Service (PaaS) and IaaS clouds such as Azure and Amazon Web Services (AWS).

The great thing about these cloud services is they allow individuals and organizations to remain productive regardless of where they are and usually regardless of what device they are using. The challenge this imposes is securing it. If I can’t get my hands on the infrastructure or backend of a service, how can I trust, monitor, and secure it? The same question continues for users accessing our apps and services on devices we don’t manage, such as bring-your-own-device (BYOD) scenarios or external guest users.

MDA is a cloud access security broker (CASB) that can be leveraged to tackle these challenges.

In this section,...

Microsoft 365 Defender XDR – centralizing investigation and response

Throughout this chapter, you have learned about the four core services that make up Microsoft 365 Defender. These services benefit from centralized investigation and incident response options in the Microsoft 365 Defender portal, accessed as a website at security.microsoft.com. We refer to this unified capability as XDR. In this section, you will learn about those capabilities.

Incidents and alerts

Security is simpler with unified review and response. When dealing with an attack, you don’t want to be slowed down and have the job complicated by navigating multiple systems and correlating events manually. Microsoft 365 Defender incidents and alerts provide such a unified system, including consolidating related objects to make the big picture clearer.

An alert is created when a service identifies risky, suspicious, or malicious activity. You will also learn later in this book how to create your...

Summary

In this chapter, we reviewed the massive scope of Microsoft 365 Defender. You learned about the core services that build up the suite, and how the Microsoft 365 Defender portal provides an XDR unified response interface for them.

You learned that MDE’s capabilities are far wider in scope than traditional endpoint protection platforms, spanning a diverse set of OSs. We then moved on to MDI, and you learned that it satisfies the need for heightened visibility into on-premises AD, with insights into potential hybrid identity threats.

To protect Microsoft 365 services such as Exchange Online, Teams, SharePoint Online, and OneDrive for Business, you learned how MDO supplements the security of EOP with Safe Attachments, Safe Links and enhanced anti-phishing, and scopes its defense beyond email and into these other services. Reaching beyond Office 365 and into other cloud services, you learned about MDA as a cloud access security broker to facilitate shadow IT discovery...

Questions

You can use the following multiple-choice questions to assess your knowledge of Microsoft 365 Defender’s capabilities. Answers can be found at the end of the book:

1. You are reviewing licensing options for your deployment. You have identified advanced hunting endpoint threats with KQL as a mandatory requirement for your 500-person and 600-device organization. Which of the following licenses is suitable? Choose all that apply:
   1. MDE Plan 1
   2. MDE Plan 2
   3. Microsoft Defender for Business
   4. Microsoft 365 E3
2. Which of the following services integrates with MDA to block data exfiltration for Azure AD authenticated web apps?
   1. Azure AD Identity Governance
   2. MDI
   3. Azure AD Conditional Access
   4. Safe Attachments
3. Which of the following most accurately describes the relationship between MDO and EOP?
   1. MDO replaces EOP
   2. MDO supplements EOP
   3. MDO is the new name for EOP
4. Which of the following are examples of the type of threat you can use MDI to help defend against? Choose all that apply:
   1. Golden...

Further reading

You may find the links listed below useful for additional reading on Microsoft 365 Defender:

• A complete comparison of MDE features and capabilities for each OS: https://campbell.scot/mdecomparison
• Aaron Dinnage’s Microsoft 365 Licensing maps, which include breakdowns of licensing types across Microsoft 365, including Microsoft Defender for Business, Endpoint, and Office 365: https://m365maps.com
• Microsoft 365 Defender’s portal – not exactly further reading, but for obvious reasons, you’re going to want to bookmark this: https://security.microsoft.com
• What’s new in Microsoft 365 Defender: a useful Microsoft Docs page for keeping in the loop with Microsoft 365 Defender’s constant changes: https://learn.microsoft.com/en-us/microsoft-365/security/defender/whats-new
• The Microsoft Security blog, which posts updates about Microsoft security services, including Microsoft 365 Defender, and other security analysis...