What is Microsoft Defender XDR? Viewing Incidents Across Workloads in the Microsoft Defender Portal

About This Article
This article was created using an automated workflow powered by generative AI. It reviews Microsoft Learn documentation regarding the Defender XDR overview, prerequisites, and portal details, organizing them including the boundaries between E3 and E5.

Verification Status: 📘 Confirmed with official Microsoft documentation • Not verified on physical hardware

Microsoft Defender XDR correlates signals from multiple Microsoft security products—such as Endpoint, Office 365, Identity, and Cloud Apps—to handle incidents, alerts, hunting, and response across the Microsoft Defender portal. Rather than thinking of it simply as an "E5-exclusive standalone application," it is easier to understand asan XDR experience that unifies signals from deployed Defender products.

Positioning in E3/E5

Microsoft guides that Defender XDR supports configurations such as Microsoft 365 E5/A5, as well as E3 combined with specific security add-on licenses. Eligibility also arises from licenses for supported products like Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, and Defender for Office 365 Plan 2.

The important point is thatbeing able to open the portal is not the same as having access to all XDR signals and features. The data that can actually be displayed and correlated depends on the products licensed and deployed.

First Step: Observing Incidents in Read-Only Mode

In the Microsoft Defender portal, go to Incidents& under >Alerts, select one existing incident if available. Do not perform any response actions; instead, observe the following:

• Severity

• Status

• Related alerts

• Related assets such as Devices, Users, and Mailboxes

• Evidence

• Attack story

What to look at here

The key value of XDR is that alerts from multiple workloads are correlated as part of the same attack, rather than appearing as isolated alerts. However, correlation is not foolproof. Account for false positives, split incidents, and undeployed data sources.

Try Changing One Parameter

Filter the severity to High only. Review the volume and targets to determine which priority levels the SOC should address first. Do not execute response actions such as resolving, isolating devices, or deleting during initial learning.

Start with Read-Only Advanced Hunting

In environments with the appropriate licenses and permissions, you can perform cross-product searches using Advanced Hunting. Begin by reading sample queries to understand the target tables and time ranges before execution.

DeviceInfo
| where Timestamp > ago(1h)
| project Timestamp, DeviceName, OSPlatform
| take 20

This is an example of observing a small amount of recent device information. Table availability and retention ranges vary depending on the environment.

For Production Use

When implementing XDR, do not stop at simply "opening the portal"; audit the extent to which signals are ingested across endpoints, email, identities, and cloud apps. In incident response procedures, separate initial triage, handoff, evidence preservation, containment, and recovery, and restrict powerful response actions to specific roles and approvals.

While Microsoft Learn highlights Defender XDR's capability to provide query-based access to historical raw signals and alert data, always verify the retention period and available data against functional and licensing conditions.

Checklist for Administrators

• Licenses for target Defender products

• Whether each workload is actually deployed

• RBAC in the Defender portal

• Available tables in Advanced Hunting

• Automated investigation and remediation settings

• Incident notifications and SOC operations

• Verify features based on additional SKUs rather than assuming functionality solely from E3/E5

Official Documentation and Primary Sources

• What is Microsoft Defender XDR?: https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender

• Prerequisites: https://learn.microsoft.com/en-us/defender-xdr/prerequisites

• Turn on Microsoft Defender XDR: https://learn.microsoft.com/en-us/defender-xdr/m365d-enable

The value of XDR lies not just in consolidating alerts onto a single screen, but in enabling the investigation of events that initially appeared to be separate defense domains as parts of the same attack.