Defender Xdr

Microsoft Defender XDR

Microsoft Defender XDR is a unified pre- and post-breach defence suite. It natively correlates signals across endpoints (MDE), identities (MDI + Entra ID Protection), email/collaboration (MDO), and cloud apps (MDA) to deliver a single prioritised incident with the full attack story - graph, timeline, evidence, and recommended actions.

When to use

Running coordinated detection and response across the Microsoft 365 estate from one portal (security.microsoft.com), instead of investigating each workload in isolation. Also when you need the attack disruption feature - it requires the XDR correlation.

Do not use this skill when ingesting third-party logs or writing custom KQL detections across non-Microsoft sources (sentinel), merging Sentinel + Defender into one portal (unified-secops-platform), or tuning endpoint-only policies (defender-for-endpoint).

Map the signal to the source workload

XDR is only as good as the workloads feeding it. Use this to confirm what's onboarded and which alerts are missing.

| If the signal is... | Source workload | Required licence | |---|---|---| | Process tree, network connection, file hash on a device | Defender for Endpoint (MDE) P2 | M365 E5 / MDE P2 | | Kerberos anomaly, DCSync, AD CS abuse, on-prem lateral movement | Defender for Identity (MDI) | M365 E5 / EMS E5 | | Risky sign-in, leaked credentials, anomalous token use | Entra ID Protection | Entra ID P2 | | Phishing URL click, malicious attachment detonation, BEC | Defender for Office 365 P2 | M365 E5 / MDO P2 | | Risky OAuth app, anomalous SaaS upload, MCAS-style alert | Defender for Cloud Apps (MDA) | MDA standalone or E5 | | Azure resource alert, AKS pod compromise | Defender for Cloud | DfC plan-based |

> Rule of thumb: if an incident shows "1 alert, 1 entity," a workload is missing. A real > attack always touches at least two of the above.

Approach

1. Onboard the core workloads first — In order: MDE (highest endpoint signal), MDI (lateral

movement), Entra ID Protection, MDO. Add MDA when SaaS apps are in scope. Each workload onboarded to its own portal still surfaces in the unified Defender portal. Verify: Incidents view shows alerts from at least 3 different ServiceSource values after 24 hours.

1. Configure unified RBAC before broad enablement — Move from per-workload roles to

Microsoft Defender XDR Unified RBAC (security.microsoft.com → Permissions). Build custom roles scoped by data source + permission level. Pilot in active-directory mode for 30 days before enforcing. Verify: a Tier-1 analyst can triage and contain but not modify policies; a Tier-3 can tune detections but not change RBAC.

1. Investigate by incident, not by alert — Incidents group related alerts, assets, and

evidence with an attack graph. Always start from the Incidents queue. The attack graph shows the kill chain across workloads in one view. Verify: open a multi-alert incident; the graph shows entities (user, device, mailbox, IP) linked across workloads.

1. Enable automatic attack disruption — Defender XDR can contain high-confidence active

attacks (disable a user, isolate a device, contain a mailbox) using cross-signal confidence ≥ 99%. Roll out in report-only for 14 days, review actions, then enforce. Verify: review Action center for past 14 days; no false positives in disruption actions.

1. Advanced hunting — Query the shared schema in KQL (DeviceEvents, IdentityLogonEvents,

EmailEvents, CloudAppEvents). Promote useful hunts into custom detection rules with incident grouping and impacted entities mapped. Verify: each custom rule has entity mappings; without them, alerts don't join into incidents.

1. Automated Investigation & Remediation (AIR) — Configure remediation level per device

group (No remediation → Semi → Full). Most environments run Full on workstations, Semi on servers.

1. Coverage review monthly — Use the MITRE ATT&CK coverage view to find blind spots.

Track median time-to-acknowledge and time-to-contain as the only two SOC metrics that matter for XDR ROI.

Guardrails

• All four workloads or you don't have XDR. A "Defender XDR with only MDE" deployment is

EDR with a fancy portal. The correlation needs at least MDE + MDI + Entra ID Protection.

• Unified RBAC first, then enable broadly. Without it, analysts get tenant-wide rights

via per-workload role groups. Lock down RBAC before granting access.

• Run attack disruption in report-only first. It will isolate devices and disable users.

Pilot the actions for 14 days, review the Action Center, then enforce.

• Custom detection rules need entity mappings. Without them, alerts don't correlate into

incidents and the attack graph is broken.

• Don't suppress incidents at the queue level. Suppress at the alert source (MDE/MDI/MDO)

so the underlying detection still tunes. Queue suppression hides the symptom, not the cause.

• The Defender portal is the SOC pane. Don't have analysts swivel between MDE, MDI, MDO

portals - that's the problem XDR exists to solve.

Common anti-patterns

• "We onboarded MDE only and call it XDR" - Half the kill chain is invisible. Onboard MDI

and Entra ID Protection before claiming XDR coverage.

• "Each Defender workload has its own analyst team" - Defeats the unified investigation

model. One incident, one analyst, all workloads.

• "Enabled attack disruption tenant-wide on day one" - Will disrupt legitimate activity

(e.g. a pen test that looks like ransomware). Report-only 14 days first.

• "Custom rules without entity mappings" - Alerts don't aggregate into incidents. Always

map at least one entity (user/device/IP).

• "Use unified RBAC for some workloads and legacy RBAC for others" - Permission overlap

creates over-privilege. Migrate all workloads or none.

• "AIR set to No remediation everywhere because we don't trust automation" - Analyst hours

wasted on rote tasks. Start Semi on workstations and review.

Example prompts

• What are the first Defender XDR controls I should enable for a new Microsoft 365 tenant?
• Walk me through how to investigate a multi-stage incident in Defender XDR using the attack graph.
• Write an advanced hunting KQL query to find suspicious PowerShell execution across devices.
• How does automatic attack disruption work and what should I configure first?
• How do I correlate an identity alert with a device alert in the same incident?
• Design the unified RBAC roles for a 3-tier SOC.
• Convert this hunting query into a custom detection rule with entity mappings.

Microsoft Learn

• Overview: https://learn.microsoft.com/defender-xdr/microsoft-365-defender
• Advanced hunting: https://learn.microsoft.com/defender-xdr/advanced-hunting-overview
• Attack disruption: https://learn.microsoft.com/defender-xdr/automatic-attack-disruption
• Custom detection rules: https://learn.microsoft.com/defender-xdr/custom-detection-rules
• Unified RBAC: https://learn.microsoft.com/defender-xdr/manage-rbac
• Incident investigation: https://learn.microsoft.com/defender-xdr/investigate-incidents
• AIR overview: https://learn.microsoft.com/defender-xdr/m365d-autoir

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: vinayaklatthe
• Source: vinayaklatthe/microsoft-security-skills
• License: MIT

Install and usage instructions live in the source repository linked above.