Microsoft Defender XDR

Score8.7 out of 10

189 Reviews and Ratings

What is Microsoft Defender XDR?

Microsoft 365 Defender combines SIEM and XDR capabilities for Microsoft 365 environments, encompassing threat detection, post-breach detection, automated investigation, and response for endpoints. Additionally, it protects cloud apps, emails and documents, and employee identities.

Categories & Use Cases

Extended Detection and Response (XDR)

Media

1 / 4

Screenshot of AH Advanced Mode

Most Frequent Users

Top 3 industries using Microsoft Defender XDR.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

23.0%

483 installations of 2,097

#2 most frequent

Finance and Insurance

10.8%

226 installations of 2,097

#3 most frequent

Manufacturing

10.8%

226 installations of 2,097

Pros

Unified visibility and seamless integration across the Microsoft ecosystem
Advanced automated response and remediation capabilities for security events
Effective threat detection, including sophisticated threats like phishing

Cons

Complex user interface and navigation
Complicated and costly licensing structure
Frequent false positives requiring initial tuning

Zak Farris

Computer and Information Systems Manager in Information Technology at Housing Authority of the Cherokee Nation (201-500 employees)

Use Cases and Deployment Scope

We use Microsoft Defender XDR to monitor for cyber threats, increase our response time to cyber events and tie into Microsoft Purview for insider risk management and data loss prevention. We can investigate and remediate threats from a single portal and Microsoft Defender XDR integrates perfectly with Purrview for insider risk and adaptive DLP policies.

Pros

Anti-phishing workflows
Threat and vulnerability scanning and detection
Insider risk detection and policy enforcement

Cons

The security portal is busy and can be difficult to navigate
Licensing is spread across multiple plans.
Struggles with non-Microsoft ecosystems like Linux or other SIEM tools besides Sentinel

Return on Investment

Automated remediation reduced manual workloads and accelerated our response time by 80%
Lowered our breach likelihood by 20%
Lowered downtime by 50%

Usability

Alternatives Considered

CrowdStrike Falcon and Cortex Xpanse by Palo Alto Networks

Other Software Used

CrowdStrike Falcon, Microsoft Sentinel, Microsoft 365 Copilot, Microsoft Security Copilot

Verified User

Technician in Information Technology (51-200 employees)

Use Cases and Deployment Scope

We use Microsoft Defender XDR to provide centralized threat detection and response across endpoints, identities, email and Microsoft 365 services. It helps us protect against phishing, malware, ransomware, account compromise and other similar threats. It's been very effective for monitoring and securing corporate endpoints, user accounts, mailboxes and cloud services.

Our IT team use it for continuous threat detection, incident investigation and remediation primarily.

Pros

Phishing and email threat protection - It gives us good visibility into who received a message, who interacted with it, and allows us to remove malicious emails from mailboxes quickly if needed.
Endpoint Security and investigation - we can see what processes are running, investigate suspicious activity, and quickly determine whether a device has been impacted by malware or other threats.
Identity Protection - by identifying unusual sign-in activity and other behavior that could indicate an account has been compromised, it makes it far easier to spot and isolate before it becomes a bigger issue.

Cons

Feature Distribution - Microsoft has been consolidating their security tools, but features are often accessed through different admin portals which can be frustrating as an administrator.
Licensing Complexity - Understanding which license is needed for specific security features can be challenging, particularly for organizations like ours with mixed licensing models.
False Positives - Initial tuning is often required to reduce the number of false positives, which can initially overshadow genuine threats that the security team need to be aware of.

Return on Investment

Faster threat detection and response
Improved operational efficiency (by consolidating multiple security functions into one platform and automating tasks)
Reduced investigation time

Usability

Other Software Used

Microsoft 365, Bitdefender GravityZone, Microsoft Purview eDiscovery, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, Exclaimer, WordPress

Verified User

Administrator in Information Technology (51-200 employees)

Use Cases and Deployment Scope

It helps us manage each device, be able to detect malicious activity before it happens, and prevent it. We could create rules to stop things from happening beforehand.

Pros

Good at reporting when it needs to.

Cons

There's a lot of false positives here and there. Maybe an easier way to suppress false alerts. Much easier.

Return on Investment

Instead of paying for two products for XDR, paying for one, just pay a Microsoft E5 license for security, and that's it.
It has reduced investigation time significantly. Before, it was all a manual process, whereas this one is giving you the alerts instantly.

Usability

Verified User

Engineer in Information Technology (51-200 employees)

Use Cases and Deployment Scope

We use Microsoft Defender XDR to secure all the endpoints in our organization. it is our primary EDR and does a great job protecting our endpoints and user Identities it integrates and works seamlessly with Azure AD and Microsoft 365 and Windows giving us a full coverage for users and their endpoints and keeping it secure, it is natively builtin with Microsoft Defender which makes it easy to onboard and secure the endpoints, the secure score capabilities and the detection timeline which it gives makes it easier for an IT Engineer or Security analyst respectively to work on it and secre the enviroment

Pros

Behavioural Detection
Native Integration with Windows 11
Isolation
Automated Response
Live Response (getting a shell to the system)

Cons

Advanced Hunting Usability and performance
Retention Periods
Transparency on Detection Logic
Reduction of False Positive Alerts

Return on Investment

Native Integration made quick onboarding possible
integration with third party tools can be bette
False positives can be reduced
Advanded hunting is good with little room for improvement
Response time are faster

Usability

Alternatives Considered

CrowdStrike Falcon and Google Security Operations

Other Software Used

CrowdStrike Falcon, Google Security Operations, Wazuh

Verified User

Engineer in Information Technology (1001-5000 employees)

Use Cases and Deployment Scope

It's part of our security suite to help with our compliance and detect threats. It's part of our IT security solution.

Pros

It integrates well with all the other Microsoft tools, as we use Outlook. It integrates really well.

Cons

Maybe just some UI improvements and not having to use Microsoft Graph for information. If we can do that through Houli, that would be nice.

Return on Investment

It catches threats, which is great. And it has a lot of true positives.

Usability

Alternatives Considered

CrowdStrike Falcon

Symantec Endpoint Security

Sophos Intercept X

CrowdStrike Falcon

Microsoft Defender XDR

What is Microsoft Defender XDR?

Categories & Use Cases

Media

Who Buys & Uses Microsoft Defender XDR

Most Frequent Users

Professional, Scientific, and Technical Services

Finance and Insurance

Manufacturing

Most Frequent Users

Small Businesses

Mid-sized Companies

Enterprises

Most Frequent Users

IT

Engineering

Other