Microsoft Defender for Endpoint

What it is

Microsoft Defender for Endpoint is Microsoft's cloud-native endpoint protection and detection platform. It combines antivirus and behavioural prevention with endpoint detection and response (EDR), automated investigation, advanced hunting and exposure management so security teams can see devices, disrupt attacks and investigate incidents from the Microsoft Defender portal.

What it helps with

- Protecting multiplatform endpoints with cloud-updated prevention and behavioural detection.
- Investigating alerts with process, network and timeline context from the sensor.
- Hunting threats across the estate with advanced query capabilities.
- Reducing attack surface through exposure management and vulnerability insights where licensed.
- Correlating endpoint signals with other Microsoft Defender workloads for XDR-style response.
- Supporting authorised blue-team and SOC workflows against malware, ransomware and living-off-the-land abuse.

Who it's for

Security operations centres, endpoint security owners and IT security leaders in organisations that standardise on Microsoft 365 or Microsoft Defender Suite for commercial endpoint detection and response.

Worth knowing

Licensing is commercial and plan-dependent (for example Defender for Endpoint Plan 1 or Plan 2, Microsoft 365 E5 Security, or Defender Suite add-ons). Features and device limits differ by plan; servers are licensed separately. Official product and pricing details are on Microsoft Security. This listing summarises publicly documented capabilities for authorised defensive use and is not an endorsement of misuse.