What Defender XDR is and how the products correlate
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.
The Settings console: every page and what it controls
Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.
Incidents, alerts, investigation and triage
How the Defender XDR incident queue works and how to run it, incident versus alert, severity, status, classification and determination values, tags and assignment, the attack story graph, evidence and response, alert tuning rules, automated investigation verdicts, the Action center, email notifications, the Graph incidents API and the Sentinel handoff.
Unified RBAC and portal permissions
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.
How the products integrate with each other
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
Secure Score, Exposure Management and Threat analytics
What Microsoft Secure Score measures and how points are awarded, how Security Exposure Management builds attack paths, critical assets and initiatives on top of MDE, MDVM, MDI, MDA, Entra and Defender for Cloud signals, how Threat analytics maps a tracked threat to your exposure, and how to turn the three into a prioritised work list for a client.