Microsoft Defender for Endpoint

Formerly Microsoft Defender ATP

It deals with all the paths from one user to end user through secure platform and encrypted data packets for confidence of company and clients. It also works with the documents, chats and even in meetings correspondence.

Usually we had lots two platforms tasked with scanning exposures, anti-malware and provision for information and threat management. But with Microsoft Defender for Endpoint we have an all inclusive platform that even integrate with other Microsoft security apps such as Microsoft Defender for Cloud for enhanced threat insights and visibility.

Microsoft Defender for Endpoint is a great platform for visibility into your network, allowing you to see what your devices see. It is a great platform for Endpoint Detection and Response. It falls short at being a traditional antivirus/antimalware platform, as it is difficult to do any whitelisting and exclusions on your own.

Defender is easy to implement a base level across an organization, but can be difficult to completely tune and manage. It is well-worth the effort and makes a great overall solution.

It is also very good and easy to setup for home users. Plus, it is free for home users using Microsoft operating systems.

Microsoft Defender for Endpoint will be super useful to you if you have a Microsoft security ecosystem in your organization because of the flawless and hassle-free integration capabilities.
Microsoft Defender for Endpoint will be a great choice when you are a big organization (more than 500 endpoints) and are dealing with customer data from a critical industry.
Although if you lie in the SMB segment, taking standalone Microsoft Defender for Endpoint plans will make you confused about which features to go for and which ones to let go off. Hence, explore other options here.

Its suitability depends on an organization's specific needs and requirements. For enterprise environments with a large number of endpoints, including PCs, laptops, and servers, Microsoft Defender for Endpoint is a good fit. Its scalability and centralized management make it an excellent option for businesses with intricate infrastructures. We have deploy for organization with 800 users.

Microsoft Defender for Endpoint is well suited in any organisation that require a secured workstations. It provides a secured environment with all the features like Attack Surface reduction, URL blocking, Files scanning for Malware. Compared to other products, MDE is cheaper and easy to manage. Being used as a antivirus solution on some devices allow us to lower our Antivirus cost.

Defender for Endpoint is an excellent choice for companies that work with a Microsoft-based platform. The endpoint does not need to be specific Windows-based, but it is very helpful when Entra is used in combination with other Defender products. That way, you can aim for a multi-layered approach based on zero trust. Sentinel is not essential but a great addition to the platform for incident management and offering longer retention. Small companies should look at ways to outsource the investigation of incidents to specialized companies; the learning curve for proper analysis is pretty steep.

It's ideal for protecting a variety of endpoints, including Windows-based PCs, servers, and mobile devices.
It's well-suited for organizations with a mix of on-premises and cloud resources.
Azure AD integration allows for seamless identity management in hybrid environments. While it supports hybrid environments, organizations with extremely complex on-premises setups may find it challenging to integrate.

Microsoft Defender for Endpoint is a cornerstone of our cybersecurity strategy, ensuring that we are prepared for the evolving challenges in the construction industry. It's a dynamic solution that provides both advanced threat detection and the tools necessary to swiftly respond to incidents. Though Robust, Enhancing it to provide clear visibility into the underlying query for default rules would be great.

If you are looking for a scalable solution with decent organization size and even if it is relatively small it works very well. If you are looking for a solution that has great offline and online coverage that allows stimulated attacks and good for testing it is highly recommended. If you often run scans and looking for something that should not hinder the performance of your endpoint you should definitely go for it.

Microsoft Defender for Endpoint has help our team identify and correct device configuration issues and provide additional layers of security to our organization that were otherwise not covered by our other security platforms at the operating system level. We've been able to successfully identify and remediate vulnerabilities in our organization and create new policies based on recommendations thanks to Microsoft Defender for Endpoint.

Microsoft defender prevented an downloaded executable with suspicious code from being installed.
This was well suited.
The executable generated by a c compiler that was not Microsoft's was considered dangerous code.
This was not suitable.

Well-Suited Scenarios: Enterprise Endpoint Protection: Microsoft Defender for Endpoint is well-suited for large organizations with numerous endpoints, such as desktops, laptops, and servers, as it provides centralized management and monitoring of security across the entire network. Microsoft Ecosystem Integration: Organizations heavily invested in the Microsoft ecosystem, using products like Microsoft 365 and Azure, will benefit from the seamless integration offered by Defender for Endpoint, allowing for more efficient threat detection and response.Scenarios Where it Might be Less Appropriate: Non-Windows Environments: While Microsoft Defender for Endpoint has expanded its cross-platform support, it may be less appropriate for organizations predominantly using non-Windows operating systems, as its core features are optimized for Windows endpoints.Small Businesses: Smaller businesses with limited IT resources might find the deployment and management of Defender for Endpoint to be more complex and resource-intensive than they require. In such cases, simpler endpoint security solutions may be more appropriate.

One of the major advantage is having an unique account and subscription for single user\pc. I don't need to configure more service on various service. It's fully iuntegrated with active directory, Microsoft account, one drive, office: it's a plus! It seems safe; no problem on any of the PCs that I manage.

I think is an appropriate tool for any scenario, but there may be costs issues for big projects, including many users/devices, dependind on the type of project. The solution is very good technically. It is quiet simple to deploy if your security policy can be supported by Microsoft Defender for Endpoint default rules. When it is necessary to customize rules it becomes more difficult.

in a client that uses a Microsoft stack it is a no brainer to use the integrated toolset that Defender offers. However if a client uses a large range of Operating Systems including MacOS and Linux, then an alternate product that offers better support for those platforms might be considered.

if you have significant no. Microsoft products in your ecosystem then Defender works extremely well. We onboarded defender as part of M365, which includes MDO and MDE both.
If your customers are spread across multiple geographies, then Defender can help you setup Compliance policies based on each reason which reduces the efforts from DPO significantly.
Apart from these, I feel it is a feature rich and stable EDR product.

When it comes to providing reports for supervisors, Microsoft Defender for Endpoint makes it simple to pull the requested information without having to spend a lot of time hunting for what has been requested. Even better than that is that I feel strongly confident in the product to actually protect our environment overall.

This is a good product for clients that just need simple security software that just works out of the box with no extra configuration needed. The product does a good job of automatically updating itself. It does not bog the systems down that it is deployed on so clients don't even know it is there.

According to me, because of the cost, it can be used where budget is moderate to high, and the system mostly relies on Microsoft based systems i.e. Windows centric environments. But with less budget, the cost of using this is too high. also for non Windows based system like MacOS or Linux based system this is not compatible. Also if there is already a security architecture in place, then integrating this defender with the third party system is way difficult and sometimes unachievable.

It is well suited for remote users and when integrated with siem, it is effective in practice threat protection. If you want to protect non MS systems like Google infra, Microsoft Defender for Endpoint may not suit your requirement. We had issues with integration of non-microsoft log sources as we had many applications to be monitored

It suits small and medium businesses quite well, especially when you don't have directly responsible IT specialist that is really concentrated on such kind of software and can spend several hours a week on Defender management and log analyzing.
Other companies most probably should look for another big player with similar product that provides wide range of higher level functionality for corresponding IT team.

Microsoft Defender for Endpoint isn't a bad security. In my opinion, it's just not the best and generally more annoying to use than alternatives. If you happen to already have licenses in your Microsoft/Office subscription, may as well use them. In my opinion, I wouldn't go out of my way to actually pay for a license when there are better products available.

I think Microsoft Defender for Endpoint is well suited for a Microsoft Enviornment that has is committed to the WIndows\Office suite of products as it easily integrates and deploys in that type of environment. In a mixed or primarily mac environment it does not have the complete integration that one may want and is hard to deploy through a MAC mdm such as Jamf.