Skip to main content

PatchHour KB

My own verified notes on the Microsoft security stack. Every article carries a status:

  • Microsoft documented: drafted from Learn, not yet run by me.
  • Lab tested: I ran it in a tenant on the date shown.
  • My recommendation: how I would do it for a client, which may differ from Learn.
  • Needs review: the watcher found an upstream change, or the article is a stub.

Sections so far:

  • Defender for Endpoint: clients, policy, onboarding, device control, EDR, troubleshooting.
  • Defender for Servers: direct onboarding vs Defender for Cloud, Linux, Plan 2 extras, response actions and Live Response, Defender for SQL.
  • Defender XDR: the portal, the Settings console page by page, incidents, unified RBAC, how the products integrate, Secure Score and Exposure Management.
  • Defender for Identity: MDI vs MDE on a domain controller, sensors, deployment, detections, troubleshooting.
  • Defender for Office 365: EOP, Plan 1, Plan 2, policies, Safe Links, email authentication, investigation.
  • Defender for Cloud Apps: Cloud Discovery with MDE, session control, app governance, policies.
  • Defender for Cloud: CSPM vs workload plans, multi-cloud onboarding, Secure Score and compliance, Storage/Containers/Key Vault, alerts.
  • Microsoft Sentinel: workspace design, connectors, analytics rules, KQL, automation, the unified portal.

Upstream changes land on the Changes page and as issues in the review queue.