Under the name Microsoft Defender, Microsoft brings together an entire family of security products. Many people know it as the antivirus protection built into Windows, which used to be called Windows Defender. In addition, there are services for endpoints, email and collaboration, identities, cloud applications, and cloud infrastructure, many of which are managed through a shared portal.
Because Microsoft repeatedly changes product names and package configurations, it is more helpful to ask about areas of protection than about names: Which areas are covered, which features are active, and who responds to alerts?
How Microsoft Defender is structured
- Endpoints: Beyond antivirus protection, Defender detects suspicious behavior on devices and enables countermeasures, see endpoint detection and response. Besides Windows, other operating systems are also supported.
- Email and collaboration: Links and attachments in emails and in services such as Teams are checked for phishing and malware.
- Identities: Suspicious activity around user accounts is detected, for example in on-premises Active Directory.
- Cloud applications: The company gains visibility and control over which cloud services are being used.
- Cloud infrastructure: Servers and services in Azure and other cloud environments are assessed and protected.
Alerts from these areas are correlated into related incidents. Microsoft calls this cross-domain approach XDR (extended detection and response). This makes it visible when a phishing email, a suspicious sign-in, and an unusual process on a laptop belong to the same attack. For certain cases, automated investigations and countermeasures can be triggered.
What became of Azure Security Center?
Azure Security Center was renamed Microsoft Defender for Cloud in 2021. This service assesses the security posture of cloud resources and supports the protection of applications and infrastructure in hybrid and multicloud environments. It is part of the Microsoft Defender product family. Microsoft describes the renaming and the scope of protection in its product FAQ.
Typical examples
- An opened attachment launches suspicious scripts. Endpoint protection detects the behavior and isolates the laptop from the network.
- A link in an email is checked again when clicked, because the target page only became malicious after delivery.
- In on-premises Active Directory, unusual queries for account information stand out, of the kind attackers use for preparation.
- Reports on vulnerabilities and configuration show which devices are missing updates or protection settings.
What companies should keep in mind
- Take stock: Which Defender features are included in the existing licenses, and which of them are actually enabled and configured?
- Check coverage: All endpoints and servers should be onboarded. Devices without active protection must stand out.
- Assign responsibility for alerts: Clarify who assesses alerts, including outside office hours, for example a security operations center.
- Configure protection features deliberately: Test additional rules, for example for attack surface reduction, in audit mode first and then enforce them step by step.
- Include identities: Defender does not replace secure sign-in. That includes multi-factor authentication and access rules in Microsoft Entra ID.
How it differs
The antivirus protection built into Windows is not the same as centrally managed endpoint protection for businesses. The latter adds behavioral analysis, central analysis, and response capabilities across all devices to the antivirus protection.
View our cyber security approach