Domain 3 carries the most weight on SC-900 (35–40%), and it asks about the services that make up Microsoft Defender XDR one by one. A question describes only a situation, such as "scan a link at the moment the user clicks it" or "detect lateral movement on an on-premises domain controller," and then lines up four products that all have Defender in the name. Unless you know exactly what each product protects, a similar-sounding wrong answer is easy to fall for.
This post follows the Defender XDR items in the skills outline that takes effect on October 21, 2026. We walk through Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps, Defender for Identity, Defender Vulnerability Management, Microsoft Threat Intelligence, and the Microsoft Defender portal, covering what each one protects, its key features, and the clue phrases that point to it in exam questions.
---
Defender XDR: Turning One Attack into One Incident
Think about security at a large shopping mall. If the front gate guards, the parking garage cameras, and the store entry logs are all run separately, nobody notices that the same intruder passed through all three. Only when the three records come into one control room and get stitched into a single person's path does the route of the intrusion become visible.
Real attacks move the same way. They start with a phishing email, infect an employee's PC, use credentials stolen from that PC to get into other servers, and finally pull data out of a cloud app. Microsoft Defender XDR (Extended Detection and Response) is an integrated defense suite that ties together the products protecting email, endpoints, identities, and cloud apps so they share signals and respond together. It covers both pre-breach prevention and post-breach detection, investigation, and response.
| Shared capability | What it does | |------|------| | Combined incidents queue | Automatically groups related alerts and affected assets from multiple products into one incident | | Automatic response | When one product finds a threat, it tells the others (for example, a malicious file found on an endpoint is removed from every mailbox) | | Self-healing | Uses automatic actions to return compromised devices, user identities, and mailboxes to a secure state | | Automatic attack disruption | When an attack in progress is identified with high confidence, it immediately isolates devices or disables accounts | | Cross-product hunting | Lets analysts query the raw data collected by all the products to look for signs of compromise |
!One attack is blocked by several Defender products and grouped into one incident
Exam tip: If a question describes "correlating alerts from multiple products to show the entire attack as a single incident," the answer is Defender XDR. Checking the security configuration of Azure, AWS, and GCP resources, on the other hand, is the job of the similarly named Microsoft Defender for Cloud, so keep the two apart.
Related post: Microsoft Sentinel and Defender XDR
---
Defender for Office 365: Email and Collaboration Tools
It works like a company mailroom that X-rays every package. Instead of only looking at the envelope, it opens the contents, stops anything suspicious before delivery, and even recalls a package that was already delivered if it later turns out to be dangerous.
Defender for Office 365 blocks phishing, malicious links, and malicious attachments that arrive through email and collaboration tools such as Teams, SharePoint, and OneDrive. It adds stronger protection on top of the spam and malware filtering built into Microsoft 365 (Exchange Online Protection).
| Stage | Key feature | Description | |------|------|------| | Prevent and detect | Safe Attachments | Opens attachments in a virtual environment first (detonation) and blocks them if they behave maliciously | | Prevent and detect | Safe Links | Checks the URL again at the moment the user clicks the link | | Prevent and detect | Anti-phishing | Detects messages impersonating executives or business partners | | Investigate | Threat Explorer, campaigns | Tracks who received a malicious message and how far it spread, and groups coordinated phishing attacks together | | Respond | Zero-hour auto purge (ZAP) | Automatically removes an already delivered message from mailboxes when it is later found to be malicious | | Respond | Automated investigation and response (AIR) | Runs investigation and remediation automatically for known threats | | Train | Attack simulation training | Sends fake phishing messages to find vulnerable users and train them |
Plan 1 provides protection features such as Safe Attachments, Safe Links, and anti-phishing. Plan 2 adds investigation and response features such as Threat Explorer, automated investigation and response, and attack simulation training.
Exam tip: "Checking a link at the moment it is clicked" is Safe Links, "running an attachment in an isolated environment to check it" is Safe Attachments, and "retroactively removing messages that were already delivered" is ZAP.
---
Defender for Endpoint: PCs, Servers, and Mobile Devices
Just as a building gets sturdy doors (prevention), motion sensors in the hallways (detection), and the ability to seal off a floor once an intrusion is confirmed (response), Defender for Endpoint handles prevention, detection, investigation, and response on every single device.
It protects Windows, macOS, Linux, Android, and iOS devices as well as servers. Windows 10 and later include built-in behavioral sensors that collect operating system signals, and cloud security analytics and threat intelligence turn those signals into detections and recommended responses.
| Feature | What it does | |------|------| | Attack surface reduction (ASR) | Blocks behaviors and settings that are easy to exploit, reducing the points where an attack can land | | Next-generation protection | Blocks new threats with Microsoft Defender Antivirus and cloud-delivered real-time detection | | Endpoint detection and response (EDR) | Detects attacks that already got in, in near real time, and takes actions such as isolating the device | | Automated investigation and remediation (AIR) | Investigates alerts automatically and acts immediately, cutting the number of alerts analysts must review | | Core vulnerability management | Finds vulnerabilities and misconfigurations on devices, ordered by risk |
Plan 1 focuses on prevention through next-generation protection and attack surface reduction. Plan 2 also includes detection and response features such as EDR, automated investigation and remediation, and core vulnerability management.
Exam tip: EDR is detection and response after a breach, while attack surface reduction is prevention before one. If you see "isolate the infected device from the network," the answer is Defender for Endpoint.
---
Defender for Cloud Apps: SaaS Apps and Shadow IT
Imagine employees quietly renting coworking spaces outside the company building. You need to know which spaces are being used and by whom, block the risky ones, and stop people from carrying confidential documents into them. Cloud apps are those coworking spaces.
Defender for Cloud Apps is a CASB (cloud access security broker). It brokers access between users and the cloud apps they use, and it does the following.
| Area | What it does | |------|------| | Shadow IT discovery | Uses network traffic and an extensive app catalog to find the cloud apps employees actually use, and rates them against more than 90 risk indicators | | Information protection | Finds sensitive data in files stored in connected SaaS apps, applies sensitivity labels, and blocks downloads to unmanaged devices | | SaaS Security Posture Management (SSPM) | Finds misconfigured security settings in each SaaS app and recommends fixes | | Threat protection | Detects unusual activity with user and entity behavior analytics (UEBA) | | App-to-app protection | Watches OAuth apps that hold permissions to critical data |
Exam tip: "Discovering cloud apps that IT has not approved" points to Defender for Cloud Apps. The similarly named Defender for Cloud protects infrastructure resources in Azure and other clouds, so the target is different.
---
Defender for Identity: On-Premises Active Directory
Instead of posting a guard in front of the bank vault, this approach puts monitoring equipment in the office that manages the vault keys. Attackers ultimately go after administrator accounts (the keys), so watching the place where accounts are issued and verified reveals an attack's progress early.
Defender for Identity is a cloud-based identity threat detection and response (ITDR) solution. It collects on-premises Active Directory signals through sensors installed on domain controllers and on AD FS and AD CS servers, and it analyzes Microsoft Entra ID signals as well. It builds a behavioral baseline for each user and flags activity that deviates from it.
| Attack stage | What it detects | |------|------| | Reconnaissance | Attempts to dig up information about users and groups | | Compromised credentials | Brute force attacks, repeated failed authentications, and group membership changes | | Lateral movement | Attempts to move around inside the network to gain more privileged accounts | | Domain dominance | Attempts to take over Active Directory, for example through remote code execution on a domain controller |
It does not stop at detection: it can also respond by disabling on-premises accounts or forcing a password reset. Its security assessments, which point out sensitive accounts exposed through risky lateral movement paths, feed into Microsoft Secure Score.
Exam tip: If the question mentions on-premises AD or domain controllers, think Defender for Identity. If it mentions risky cloud sign-ins (anonymous IP addresses, leaked credentials, and so on), think Microsoft Entra ID Protection. The two complement each other.