This section covers some of the most frequently asked questions regarding privacy and data handling for Defender for Endpoint.
Note
This article explains the data storage and privacy details related to Defender for Endpoint and Defender for Business. For more information related to Defender for Endpoint and other products and services like Microsoft Defender Antivirus and Windows, see Microsoft Privacy Statement, and also Windows privacy FAQ.
What are we collecting?
Microsoft Defender for Endpoint collects information from your configured devices and stores it in a customer-dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes.
Information collected includes file data (file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and device details (device identifiers, names, and the operating system version).
Microsoft stores this data securely in Microsoft Azure and maintains it in accordance with Microsoft privacy practices and Microsoft Trust Center policies.
This data enables Defender for Endpoint to:
Proactively identify indicators of attack (IOAs) in your organization
Generate alerts if a possible attack was detected
Provide your security operations with a view into devices, files, and URLs related to threat signals from your network, enabling you to investigate and explore the presence of security threats on the network.
Microsoft doesn't use your data for advertising.
Data location
Defender for Endpoint operates in the Microsoft Azure data centers in the European Union, the United Kingdom, the United States, Australia, Switzerland, or India. Customer data collected by the service might be stored in: (a) the geo-location of the tenant as identified during provisioning or, (b) the geo-location as defined by the data storage rules of an online service if this online service is used by Defender for Endpoint to process such data. For more information, see Where your Microsoft 365 customer data is stored.
(a) the geo-location of the tenant as identified during provisioning; or
(b) the geo-location as defined by the data storage rules of an online service if this online service is used by Defender for Endpoint to process such data.
Data Retention
Data from Microsoft Defender for Endpoint is retained for 180 days, visible across the portal.
Your data is kept and is available to you while the license is under grace period or suspended mode. At the end of this period, that data will be erased from Microsoft's systems to make it unrecoverable, no later than 180 days from contract termination or expiration.
In the advanced hunting investigation experience, it's accessible via a query for 30 days.
Data sharing for Microsoft Defender for Endpoint
Microsoft Defender for Endpoint shares data, including customer data, among the following Microsoft products, also licensed by the customer.
Microsoft Defender XDR
Microsoft Defender for Cloud Apps
Microsoft Sentinel
Microsoft Tunnel for Mobile Application Management - Android
Microsoft Defender for Cloud
Microsoft Defender for Identity
Microsoft Security Exposure Management (public preview)
Learn about Microsoft 365 privacy standards, the reasons we have them in place, and how they differentiate Microsoft in protecting and respecting customer data.
Plan and execute an endpoint deployment strategy, using essential elements of modern management, co-management approaches, and Microsoft Intune integration.