The Defender portal emphasizes quick access to information, simpler layouts, and bringing related information together for easier use. It includes Microsoft Defender XDR and features and capabilities of other Microsoft security solutions that you have provisioned access to.

By default, MSSP customers access their Microsoft Defender XDR tenant through the following URL: https://security.microsoft.com/.

Microsoft Defender XDR is an XDR platform that provides security across your multiplatform endpoints, hybrid identities, email, collaboration tools, and cloud apps. It uses incident-level visibility across the cyberattack chain, automatic cyberattack disruption, and unified security and access management to accelerate responses to sophisticated cyberattacks.

Get an overview of what to expect when running Microsoft Defender for Endpoint in the Microsoft Defender portal

Learn how to enable Microsoft Defender XDR and start integrating your security incident and response.

Step 1: Turn on Microsoft Defender XDR You'll first need to turn on the service by making sure you have the right license in place and roles are assigned so that you can access the portal.

Learn how to manage access to Microsoft Defender XDR capabilities with Microsoft Entra global roles.

Learn about the robust security solutions in Microsoft Defender XDR so that you can better protect your enterprise across attack surfaces.

Secure and gain visibility across endpoints, identities, emails, SaaS apps, and cloud with the XDR solution from Microsoft Security. Get started today.

October 2, 2025 - It continuously learns from this data, identifying patterns that indicate potential threats, such as unusual login attempts or abnormal network traffic. By using behavioral analytics, it understands what’s normal for a user or system and detects deviations that could signal an attack. This automated detection reduces the need for manual investigation, quickly identifies threats, and prioritizes them based on severity, enabling faster and more efficient responses to incidents. Azure XDR seamlessly integrates with a wide range of Microsoft services and products, including Microsoft 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint, Azure Active Directory, and more.

As a workaround, I recommend that you create a new user and assign appropriate roles as mentioned here: https://learn.microsoft.com/en-us/defender-xdr/prerequisites#required-permissions

In other words, XDR combines user login data with device information to block cyber-attackers before they can take action. ‍ · By providing comprehensive threat detection, rapid response capabilities, and smooth integration with existing security infrastructure, Defender XDR enables security teams to anticipate cyber threats and protect critical assets. Defender XDR helps IT teams protect and detect threats in their organizations, exploiting information from the Microsoft ...

The Microsoft Defender XDR platform addresses this challenge by providing a holistic defense that mitigates the risk of such breaches at every stage: Microsoft Defender for Office 365 blocks phishing attempts by scanning email attachments and links. Microsoft Defender for Endpoint detects suspicious device behavior and isolates compromised machines. Microsoft Entra ID Protection detects potential identity threats and blocks suspicious login ...

Learn about the services and features available with Microsoft Defender XDR in the Microsoft Defender portal.

The Defender portal combines services like Microsoft Defender XDR, Microsoft Sentinel, Microsoft Security Exposure Management, and Microsoft Security Copilot for unified security operations.

You must at least be a security administrator in Microsoft Entra ID to turn on Microsoft Defender XDR.

Learn about how Microsoft Defender for Office 365 operates in the Microsoft Defender portal.

Microsoft Defender XDR takes automatic action to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities.

The ThreatDefence application must be registered in Microsoft Entra ID. Defender XDR uses the same application, with additional permissions configured.

May 19, 2023 - For instance, while EDR may provide information about malware running on a machine, XDR goes further by correlating and presenting additional details such as the phishing email that was clicked on, the downloaded malware, and network traffic logs associated with that machine. This automatic correlation of data makes XDR a highly powerful tool for security analysts. Microsoft Defender stands as Microsoft’s XDR solution, offering the most comprehensive capabilities in the market.