L16. Defender XDR & the Unified Portal
Course outlineLesson 16 of 18
Microsoft Defender XDR unifies endpoint, identity, email, and cloud app protection into one portal. The AZ-500 tests the difference between XDR and SIEM, and which Defender product protects which surface.
XDR vs SIEM
| Dimension | SIEM (Sentinel) | XDR (Defender XDR) |
|---|---|---|
| Data source | Any log source | Microsoft security products |
| Detection | Custom KQL rules | Built-in ML correlations |
| Response | Playbooks (Logic Apps) | Automated remediation built-in |
| Focus | Compliance, investigation | Endpoint plus identity plus email threat response |
Defender XDR Components
| Product | Protects |
|---|---|
| Defender for Endpoint (MDE) | Windows, macOS, Linux, Android, iOS devices |
| Defender for Identity (MDI) | On-premises AD, Entra ID identity signals |
| Defender for Office 365 (MDO) | Exchange Online, SharePoint, Teams |
| Defender for Cloud Apps (MDCA) | SaaS apps, shadow IT, conditional access app control |
The Unified Security Portal (security.microsoft.com)
Since 2024, Microsoft Sentinel is accessible inside the Defender XDR portal (security.microsoft.com): not just portal.azure.com. The exam tests both navigation paths.
Microsoft Defender for Identity (MDI)
MDI monitors on-premises Active Directory Domain Controllers for identity-based attacks:
- Pass-the-Hash, Pass-the-Ticket
- Kerberoasting, AS-REP Roasting
- Lateral movement via SMB
MDI requires a sensor installed on each domain controller. Signals flow to Defender XDR for correlation. Exam tip: MDI detects on-premises AD attacks. Entra ID Protection detects cloud identity risks. For hybrid environments, you need both.
- ✓SIEM (Sentinel) = any log source, custom rules, compliance. XDR = Microsoft products, built-in ML, automated remediation
- ✓Sentinel and Defender XDR complement each other: Defender XDR data flows into Sentinel via connector
- ✓MDI detects on-premises AD attacks (Pass-the-Hash, Kerberoasting); Entra ID Protection covers cloud identity
- ✓MDI requires a sensor on every domain controller: signals flow to Defender XDR for correlation
- ✓Unified portal (security.microsoft.com) now hosts both Defender XDR and Microsoft Sentinel
1. What is the primary distinction between SIEM and XDR in the Microsoft security stack?
2. Defender for Identity monitors which data source to detect lateral movement and credential attacks in hybrid environments?
3. In the Microsoft Defender XDR unified portal, what is an 'incident'?
Recommended: Pluralsight
This free course covers the theory. Pluralsight adds structured video courses, hands-on Azure labs, and timed practice exams to make it stick before exam day.