How the Defender for Identity cloud service and its sensors fit together, what the classic v2.x sensor and the MDE-integrated v3.x sensor collect on domain controllers, AD FS, AD CS and Entra Connect servers, what leaves the server, how the Directory Service Account is used, and how to size, connect and keep sensors healthy.
The 19 ASR rules with GUIDs, modes and OS support, how to roll them out audit to warn to block, per-rule and global exclusions, and where to read the results.
The two Defender for SQL plans in Defender for Cloud, what vulnerability assessment and Advanced Threat Protection give you on Azure SQL and on SQL Server on VMs or Arc, how the enhanced agent collects data, and how to enable, verify and troubleshoot both plans.
Deploy the Defender for Identity sensor on domain controllers, AD FS, AD CS and Entra Connect servers, pick v2.x or the MDE-based v3.x sensor, set up the directory service account and audit policy, and run response actions from the Defender portal.
Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.
Install the mdatp package on supported Linux distros with the installer script, the package repo or the Defender for Cloud MDE.Linux extension, onboard it, set proxy and AV policy through mdatp_managed.json or security settings management, and tune the eBPF sensor.
Let Defender for Servers push the MDE.Windows and MDE.Linux extension to Azure VMs and Azure Arc machines, with the Endpoint protection setting, direct onboarding, multicloud connectors, verification and offboarding.
Onboard Windows Server 2012 R2 through 2025 straight to Defender for Endpoint with the unified agent, the built-in sensor, local script, Group Policy, Configuration Manager or the Defender deployment tool, without Azure or Defender for Cloud in the path.
How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.
What Defender for Identity detects that an MDE-onboarded domain controller cannot, how the v3.x sensor rides on the MDE agent, what the classic v2.x sensor still does better, licensing, and a three-way comparison table.
What you only get by running servers through Defender for Cloud on Plan 2, how each piece works, where the toggles are, and how to prove it is doing something.
Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.
Push Defender AV, EDR, firewall and ASR policy from Intune or the Defender portal to devices that are onboarded to MDE but not enrolled in Intune, using synthetic Entra device objects and the MDE-Management tag.
A diagnostic workflow for Defender for Identity, from sensor install failures and services stuck starting, through every documented health issue and its fix, to the audit policies that feed detections and why a known-bad action raised no alert.