Microsoft Defender XDR

Microsoft Defender XDR (extended detection and response) unifies signals from Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps into a single incident view within the Microsoft Defender portal. By correlating alerts across these pillars automatically, it reduces the time a security team spends pivoting between separate consoles to reconstruct an attack chain. A common exam confusion is treating Defender XDR as endpoint-only: Defender for Endpoint covers devices, while XDR is the cross-workload correlation layer above it. Automatic attack disruption can isolate a compromised device or suspend a risky account mid-attack.