Manage security and threats by using Microsoft Defender XDR
The unified suite
Microsoft Defender XDR correlates signals from Defender for Office 365 (email and collaboration), Defender for Endpoint (devices), Defender for Identity (on-premises Active Directory), Defender for Cloud Apps (SaaS), and Defender Vulnerability Management inside the Microsoft Defender portal. Related alerts roll up into incidents, and advanced hunting runs KQL across tables such as EmailEvents, EmailUrlInfo, DeviceProcessEvents, and IdentityLogonEvents.
Email and collaboration protection
Preset security policies apply Standard or Strict protection in one step; custom anti-spam, anti-malware, anti-phishing, Safe Attachments, and Safe Links policies allow tuning, and the most specific or highest-priority rule wins. Anti-phishing covers spoof intelligence, impersonation protection, and mailbox intelligence. Safe Attachments detonates unknown attachments, while Safe Links rewrites and evaluates URLs at click time and by default does not scan internal-to-internal mail. The Tenant Allow/Block List overrides filtering verdicts for senders, domains, URLs, and files. Quarantine policies decide what recipients may do with held messages and whether they are notified.
Endpoint and response
Onboard devices by script, Group Policy, or Intune, then assign device groups and configure antivirus, attack surface reduction rules, EDR in block mode, and automated investigation and response with remediation levels (full, semi, or no automation). Tune noisy alerts and add custom detections to close coverage gaps. Attack simulation training tests user awareness, and Secure Score tracks posture improvements.
Rule of thumb: when a user reports a suspicious message, submit it to Microsoft for analysis and then hunt the sender, URL, and campaign across all mailboxes in advanced hunting; deleting the single message only removes one symptom.
Traps: assuming Safe Links applies to internal mail, mixing up quarantine policies with anti-spam policies, and forgetting that alert policies and incidents live in the Defender portal rather than the Microsoft 365 admin center.