Microsoft 365 Defender: Complete Component Guide

Microsoft 365 Defender: Understanding Unified Security Architecture

Microsoft 365 Defender is not a simple security product: it is an integrated suite of services, tools and extended detection and response capabilities (XDR – Extended Detection and Response). Its objective is to concretely implement Microsoft's Zero Trust model, according to which no identity, device or application is considered trustworthy by default — everything must be verified continuously.

This article presents all the key components available in the security.microsoft.com portal, their respective functions, and priority actions to implement to secure your Microsoft 365 tenant.

Licensing Model: Three Levels of Protection

Before exploring the features, it is essential to understand the licensing model, which directly determines the available capabilities.

• EOP: included in all Microsoft 365 subscriptions, it ensures basic email protection.
• Defender Plan 1 (included in Microsoft 365 Business Premium): adds Safe Attachments, Safe Links and advanced detection capabilities.
• Defender XDR / Plan 2 (E5 or E5 Security): activates automated incident response, Attack Simulator, advanced Threat Analytics and complete integration with Defender for Identity and Defender for Endpoint.

Secure Score: Your Security Posture Dashboard

Secure Score is the recommended starting point for any administrator taking over a Microsoft 365 tenant. It provides a numeric assessment of your organization's security posture, broken down by domain:

• Identity: MFA policies, conditional access, phishing-resistant credentials
• Data: information protection, DLP, sensitivity labels
• Applications: OAuth policies, Shadow IT, Defender for Cloud Apps
• Devices: Intune compliance, patch management, attack surface

Each recommendation is accompanied by a step-by-step implementation guide, a change history and the ability to assign the action to a team member.

Access: Exposure Management > Secure Score in the Defender portal.

Email and Collaboration Protection: Essential Policies

Basic Policies Included in EOP

All Microsoft 365 customers automatically benefit from the following policies via Exchange Online Protection:

• Anti-malware: 9 scanning engines in parallel
• Anti-spam: inbound and outbound filtering
• Anti-phishing: detection of impersonation attempts

These policies are accessible via Email & Collaboration > Policies & Rules > Threat Policies.

Safe Attachments: The First Line of Defense

Safe Attachments is one of the most critical features available with Defender Plan 1 (Business Premium, E5, E3 + Defender add-on). Its operation is based on a detonation mechanism:

1. The message is delivered to the user without the attachment
2. The attachment is executed in an isolated sandbox environment
3. Analysis verifies: code execution, registry calls, malicious behaviors
4. If the attachment is safe, it is reattached and delivered (delay of a few seconds)
5. If it is malicious, it is permanently deleted

Safe Links: Protection Against Malicious URLs

Safe Links protects your users against more than 4 billion known and unknown malicious links. It operates in real-time on:

• Outlook emails
• Microsoft Teams messages
• Office documents

The behavior is as follows:

• Link being analyzed: yellow visual indicator
• Malicious link detected: blocking with red warning page
• Safe link: transparent redirection to destination

Configuration is similar to Safe Attachments: Email & Collaboration > Policies & Rules > Threat Policies > Safe Links. Default settings are sufficient in most cases for immediate protection.

Attack Simulator: Test Human Resilience

Available with Defender Plan 2 (E5 / E3 + add-on), Attack Simulator allows you to launch simulated phishing campaigns against your own users. Key features include:

• Library of templates based on latest real attack techniques
• Targeting by group, department or individual user
• Automatic training modules for users who click on lures
• Follow-up reports: click-through rate, reporting rate, progression over time

Defender for Identity: Securing Active Directory and Hybrid Identities

Defender for Identity monitors the behavior of user accounts and entities through UEBA (User and Entity Behavior Analytics). It is particularly effective in hybrid environments using on-premises Active Directory.

Deploying the Sensor on Domain Controllers

The sensor analyzes in real-time:

• Pass-the-hash and pass-the-ticket attacks
• Attempts at LDAP reconnaissance
• Suspicious modifications to privileged groups
• Abnormal login behaviors (time, location, frequency)

Defender for Endpoint: Protecting Workstations and Servers

Defender for Endpoint covers all endpoints: Windows, macOS, Linux, iOS and Android devices. Onboarding can be performed via multiple methods.

PowerShell Script for Post-Onboarding Verification

After deployment, you can verify that the Defender for Endpoint service is active on a Windows computer with the following script:

1# Verification of the Sense service status (Defender for Endpoint)
2$service = Get-Service -Name "Sense" -ErrorAction SilentlyContinue
3 
4if ($service) {
5    Write-Host "Defender for Endpoint - Status: $($service.Status)" -ForegroundColor Green
6    
7    # Verification of sensor version
8    $defenderInfo = Get-MpComputerStatus
9    Write-Host "MDE Platform Version: $($defenderInfo.AMProductVersion)"
10    Write-Host "Latest Signature Update: $($defenderInfo.AntivirusSignatureLastUpdated)"
11} else {
12    Write-Host "The Sense service was not found. Onboarding was not completed." -ForegroundColor Red
13}

PowerShell Script for Bulk Onboarding via Intune (Compliance Verification)

1# Verification of MDE onboarding on multiple machines via Get-MgDevice (Microsoft Graph)
2# Prerequisites: Microsoft.Graph module installed and connected
3 
4Connect-MgGraph -Scopes "Device.Read.All"
5 
6$devices = Get-MgDevice -All | Select-Object DisplayName, OperatingSystem, OperatingSystemVersion, TrustType
7 
8foreach ($device in $devices) {
9    Write-Output "[$($device.DisplayName)] OS: $($device.OperatingSystem) $($device.OperatingSystemVersion) | Trust: $($device.TrustType)"
10}

Available Onboarding Methods

• Microsoft Intune: recommended method for cloud-first and hybrid environments
• Group Policy (GPO): for on-premises Active Directory environments
• Local Script: manual deployment or via SCCM
• Microsoft Defender for Cloud: for Azure virtual machines

Configuration access is done via Settings > Endpoints > Onboarding in the Defender portal.

Threat Intelligence: Anticipating Emerging Threats

The Threat Intelligence > Threat Analytics section is designed for SOC analysts. It provides:

• Microsoft analyst reports on active threats (APT groups, ransomware, MITRE ATT&CK techniques)
• Impact on your tenant: do you have endpoints exposed to this threat?
• Indicators of Compromise (IoC) associated
• Recommended actions with prioritization
• Patching status of your endpoints against exploited CVEs

Exposure Management: Visualize and Reduce Attack Surface

The Exposure Management section provides a consolidated view of your organization's attack surface:

• Attack Surface Map: mapping of potential attack paths
• Vulnerability Management: CVEs detected on your endpoints, with CVSS score and available patch
• Secure Score: (see dedicated section above)
• Data Connectors: integration of third-party sources (AWS, GCP, SIEM tools)

Microsoft 365 Defender Components Summary

Conclusion: Where to Start?

Given the wealth of available components, here are the recommended action priorities for an effective start with Microsoft 365 Defender:

1. Consult Secure Score and address high-impact recommendations (MFA, Conditional Access)
2. Enable Safe Attachments and Safe Links immediately if you have the appropriate licenses
3. Deploy the Defender for Identity sensor on your AD domain controllers
4. Onboard your endpoints via Intune to benefit from EDR protection
5. Consult Threat Analytics regularly to stay informed about active threats
6. Launch an Attack Simulator campaign to measure your users' resilience

To learn more, explore the training resources available directly in the Defender portal via Learning Hub, which points to official Microsoft Learn paths.