Microsoft Defender for Endpoint (formerly Microsoft Defender ATP) is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management.
$2.50
per user/per month
Microsoft Purview Data Loss Prevention
Score 7.9 out of 10
N/A
Microsoft Purview Data Loss Prevention is used to provide intelligent detection and control of sensitive information across Office 365, OneDrive, SharePoint, Microsoft Teams, and on the endpoint. It also helps prevent data loss through identifying and preventing risky or inappropriate sharing, transfer, or use of sensitive data on endpoints, apps, and services.
It's well-suited if you're already a Microsoft shop, particularly if there are budgeting concerns or it's a smaller operation where you might not have the finances to have a more diverse toolset. Falling back on something built-in because you're already a Microsoft customer is really helpful. Areas where I would say it's less appropriate are if you're not already a Microsoft customer. If you're a Google shop, then maybe it doesn't make the most sense. And then I'd say if you have large budgets, a wide diversity of systems, or a very large footprint, then having something ancillary, or at least another tool, can be impactful as far as making sure you have better visibility.
It's well-suited if you're really deep in the tech stack. If you're an exchange organization that's using the O365 suite, that's in Entra, that's in Azure, it's really great visibility. I think it probably falls apart very quickly if you don't have data from all those planes to feed it.
The big thing for us is on endpoint, it kind of integrates with everything else that we already have because we use Microsoft completely. And so that helps us with being able to integrate, and send things over to Azure Sentinel as we need to as well.
I think from a coverage standpoint, it's pretty comprehensive. The areas it covers, of course, include the Microsoft stack, but also focus on using the definitive cloud apps integration to extend visibility and control to third-party cloud apps, endpoints, and even Macs. So those are capabilities.
Its comprehensiveness, its simplicity of creating the policies in one place, are definitely one of the plus points the solution has.
Differently. The biggest thing is that if there is a particular update to it that, for whatever reason, is incompatible with, like, an EHR or some software that we have, there is no easy way to roll back. There's not just like a one click rollback or anything like that. So we have to get in and do that. We've actually written a tool ourselves to manage that, so that's something that's missing.
The main thing is that, within the product's story, some functionalities were deprecated, and traceability was one of them. That meant that before I could tell or pinpoint on a world map where a particular type of access attempt was happening, and now I cannot do that anymore. So that was useful because I could understand how far out a document made it, and then where the issue was. Was an employee trying to open it at home, or was it an external party altogether? I couldn't do that anymore.
The second bit that has room for improvement, is the fact that we have quite a lot of legacy documents that were labeled. So they are from previous versions of Office. And at the moment, since November last year, the already labeled documents are not being protected by the labels.
Cost add-ons for Security features is nickel and diming the process to keep pace with cybercrime. Limited Education budgets require us to be more pro-active in finding cost-effective measures to protect our devices, staff and students. Defender is a strong, well-featured product that is pricing itself out of the education market
It's fairly good whenever you talk about leveraging it, but your staff just has to go read the tech articles. Microsoft does a great job of producing Microsoft technical articles. And so if you can go out there and take the time to read them, you will learn how to do it. It's just not intuitive from the screen if you're just kind of going through it for the first time.
I think it is very easy for the end user once it's applied. On the configuration side, there's a learning curve to that, but there's always a learning curve for anything. So I think the product does what it needs to do. It is easy enough to use.
Microsoft Defender for Endpoint chugs along just fine no matter what we throw at it and what systems it's running on. It doesn't take up a lot of resources either, so that's welcomed.
The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session
Deployment was handled by our team here and everything went pretty smoothly. We did have a few hiccups in our test group, but that only took a bit to get ironed out.
I've used Sophos, Bitdefender, SentinelOne, and, of course, Microsoft Defender for Endpoint. We chose this at the time because we were such a Microsoft shop that it just seemed to integrate well with all the other things that we had set up with Microsoft.
Symantec or now? Brocom. Forcepoint, GPV. I'm trying to think of, there's a couple more. I can't think of the top of my head. I would say closer to the bottom then rather than the top. So because of the fact that yes, it integrates well. But in terms of the actual functionality of DLP, there are other requirements that they just don't have the features for yet.
I'd probably say improved security outcomes and reduced risks. Vulnerability management has been crazy over these past few years just because of the amount of vulnerabilities that are getting discovered and reported. But Microsoft Defender for Endpoint has given us great visibility around that, even though it's a lot. And from that data, we have used it to help fix vulnerabilities, work with our systems team, and work with the appropriate teams to get those vulnerabilities resolved.
From an ROI perspective, being able to have a robust DLP capability within 365 and with eShare, again, providing the defensive depth and keeping data 365 gives both us as well as our customers an ROI by being able to not use third party repositories to share data externally and by keeping data inside of 365. It gives me much more visibility into my data landscape. One of the things we advise our customers to do when they're starting to explore the advanced capabilities of Microsoft Purview Data Loss Prevention, for example, is to use that DLP product to monitor and understand the flows of sensitive data within the organization. By being able to look at that DLP, identify those sensitive niche types, and see which transactions occur internally within the organization, I get a clearer picture of what I'm doing.
