Microsoft Defender XDR
Elevate your security with unified visibility, investigation, and response across the cyberattack chain with an industry-leading extended detection and response (XDR) solution.
OVERVIEW
Supercharge your security operations center (SOC) with AI-driven XDR
Gain incident-level visibility across the cyberattack chain and empower your SOC team with automatic disruption and accelerated response to multi-domain threats.
- Discover and help secure endpoint and network devices across your multiplatform enterprise.
- Manage and secure hybrid identities and simplify employee, partner, and customer access.
- Modernize how you secure apps and generative AI systems, elevate your security posture, and defend against software as a service (SaaS)-based cyberattacks.
- Protect your email and collaboration tools from advanced cyberthreats, such as phishing and business email compromise.
CAPABILITIES
Unify security with XDR
Stop cyberattacks early with automated disruption
Shield high-risk assets and stop attacks in real time with predictive insights and automated containment.
Enable rapid response with XDR-prioritized incidents
Remediate threats faster by visualizing the full attack chain, prioritizing incident-level investigations, and surfacing critical alerts with the incident queue assistant.
Detect blind spots with AI-powered threat hunting
Proactively uncover hidden threats across your environment with the Threat Hunting Agent. Hunt for cyberthreats in natural language with speed and confidence—no advanced query skills required.
Empower defenders with AI-driven capabilities and agents
Protect across the SOC lifecycle with the speed and scale of AI with Security Copilot embedded into Microsoft Defender.
Manage multitenant environments effectively
Centralize incident management with a consolidated view of incidents, devices, and potential vulnerabilities.
Industry recognition
Microsoft Security is a recognized industry leader.
-
-
A Leader in the IDC MarketScape for XDR
Microsoft has been named as a leader in the IDC Worldwide Extended Detection and Response Software 2025 Vendor Assessment.3
CUSTOMER STORIES
What customers are saying
Frequently asked questions
- Microsoft Defender XDR (formerly Microsoft 365 Defender) is an industry-leading XDR platform. It delivers a unified investigation and response experience and provides native protection across endpoints, IoT devices, hybrid identities, email and collaboration tools, and cloud applications with centralized visibility, powerful analytics, and automatic cyberattack disruption.
Gain a broader set of protections with Microsoft Defender XDR, including email security as well as identity and access management as critical preventative solutions. Benefit from auto-healing capabilities for common issues and scale your security operations center (SOC) team with XDR-automated disruption to help protect against advanced cyberattacks more effectively, while safeguarding business continuity. - Microsoft Defender XDR is an XDR platform that provides security across your multiplatform endpoints, hybrid identities, email, collaboration tools, and cloud apps. It uses incident-level visibility across the cyberattack chain, automatic cyberattack disruption, and unified security and access management to accelerate responses to sophisticated cyberattacks. Microsoft Sentinel complements these capabilities with security and information event management (SIEM) and security orchestration, automation, and response (SOAR) to ingest logs from your entire digital estate—providing further automation, response, and cyberthreat tracking across systems.
- Microsoft Defender XDR is the unified portal experience encompassing various security solutions. Access the Microsoft Defender XDR portal and XDR features with any of these licenses:
- Microsoft 365 E5 or A5
- Microsoft 365 E3
- Microsoft 365 E3 with the Microsoft Enterprise Mobility + Security E5 add-on
- Microsoft 365 A3 with the Microsoft 365 A5 security add-on
- Microsoft Enterprise Mobility + Security E5 or A5
- Microsoft Defender for Endpoint (Plans 1 and 2)
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Office 365 (Plans 1 and 2)
- Microsoft Defender Vulnerability Management
- Microsoft Defender XDR provides a unified XDR experience for the following products:
Get started
Protect everything
Make your future more secure. Explore your security options today.
- [1]Forrester, Forrester New Wave, Forrester Wave, and The Total Economic Impact are trademarks of Forrester Research, Inc.
- [2]The Forrester Wave™: Extended Detection And Response (XDR) Platforms, Q2 2024, June 2024.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. For more information, read about Forrester’s objectivity here. - [3]IDC MarketScape: Worldwide Extended Detection and Response Software 2025 Vendor Assessment, IDC #US52997325e, September 2025.
Follow Microsoft Security