Item: Microsoft Defender for Endpoint
Rating: 10
Author: Joe Aldeguer

Use Cases and Deployment Scope

MDE is Microsoft's latest cybersecurity tool which takes a holistic approach to protect my organization from known and zero-day threats. I love the fact that I don't need to stitch together a diverse solution to increase my organization's security posture. I only have to use one login to manage my dashboard. MDE is compatible with all endpoints in my organization. I have macOS, iOS, Windows server, Windows 10, and Ubuntu Linux on-boarded. It is an EDR, XDR that is mapped against the MITRE ATT&CK framework.

Pros and Cons

Compatible with macOS, iOS, Android, Windows Server, Windows 10 and Linux
It runs natively on Windows it is not a bolted on solution. Once you have the correct license it is easy enough to light up the application to protect the endpoint
Integrated with Microsoft Intune
It is designed to detect and remediate adversary tactics from the MITRE knowledge base.
Microsoft analyzes billions of signals daily to detect attacks against O365 tenants these same signals are fed into ML to further fine-tune MDE. How many other solutions out there will have access to this vast amount of data to analyze to train their ML?
Automated detection and remediation of threats with a graphical timeline view of how the treat got into the device and was stopped
It has its own vulnerability scanner to feed data into the dashboard so you can see daily which endpoints need to be patch first based on its value
It comes with an advanced hunting tool using the kusto query language to search your tenant for threats
It can keep 180 days of log data
From one bundled license I can protect Exchange online email, Sharepoint, Microsoft Teams, One Drive, Azure identities, AD, endpoints

Web filtering on the macOS it not available yet
They recently made it easier to on-board macOS endpoints using Microsoft Intune by deploying it as an app. It used to take a lot of more configuration profiles to set up. For older macOS Sierra using the older extensions it will still require the multiple steps to on-board to MDE
They need to integrate Microsoft Cloud app into the new dashboard of MDE
Reduce the memory overhead of the mdatp agent running on Linux

Most Important Features

Holistic cybersecurity tool
Compatibility with all of my OS
It is like having my own SOC for my small organization

Return on Investment

You will have to move up to Microsoft 365 E5
You can get rid of other 3rd party security tools and just use the Microsoft ecosystem

Alternatives Considered

Avast Business Antivirus

MDE is a complete solution from one vendor.

Key Insights

Do you think Microsoft Defender for Endpoint delivers good value for the price?

Not sure

Are you happy with Microsoft Defender for Endpoint's feature set?

Yes

Did Microsoft Defender for Endpoint live up to sales and marketing promises?

Yes

Did implementation of Microsoft Defender for Endpoint go as expected?

Yes

Would you buy Microsoft Defender for Endpoint again?

Yes

Likelihood to Recommend

Small or large organizations will benefit from using MDE. They need to provide a way to buy MDE as a standalone add-on product not only make it a bundled feature in Microsoft 365 E5. I wish it had the ability to deploy updates to 3rd party apps when the vulnerability scanner discovers a vulnerability. Currently, I have to use a 3rd party tool to address this gap.

Products Replaced

Yes - I was using Avast Business edition to protect my macOS endpoints. I decided to go with Microsoft Defender for Endpoint to get deeper protection. I don't like the idea of having to log in to different portals to manage my endpoint protection.

Key Differentiators

Product Features
Product Reputation

The cross-platform solution providing protection to all of the operating systems we used at work.

Support Rating

The first time I tried to onboard my macOS endpoints to MDE I struggled for quite a bit. I had to reach out to Microsoft's MDE support team. The tech was very helpful in walking me through the steps during a screen share session.

Microsoft Defender for Endpoint Customer Support Pros and Cons

Pros	Cons
Quick Resolution Good followup Knowledgeable team Problems get solved Kept well informed No escalation required Immediate help available Support cares about my success Quick Initial Response	None

Premium Support

No. Tech support through phone or email comes with Microsoft 365 E5 license.

Holistic approach to Cybersecurity

Overall Satisfaction with Microsoft Defender for Endpoint (formerly Microsoft Defender ATP)