Edit

Microsoft Defender Experts

Microsoft Defender Experts is a suite of expert-led security services that help your organization defend against cybersecurity threats, build cyber resilience, and strengthen your security operations. The suite brings together Microsoft's security expertise and threat intelligence with AI-accelerated technology, giving you direct access to seasoned experts who detect, hunt, and respond to threats and provide guidance tailored to your environment.

The suite offers the following services tailored to different security needs:

Service What it does Coverage
Defender Experts MDR Managed extended detection and response Microsoft Defender environment
Defender Experts Hunting Proactive threat hunting Endpoints, Microsoft 365, cloud apps, identity, and servers
Defender Experts for Servers Managed detection and response for servers Azure, AWS, and GCP via Defender for Cloud
Defender Experts Threat Intelligence Curated threat briefings and proactive threat alerts Your industry, geography, and environment
Defender Experts Cybersecurity Incident Response Incident preparation, response, and recovery Microsoft 365, Azure, and Windows environments

Note

Any incident response services offered by Defender Experts are offered under the Defender Experts Service Terms.

Defender Experts MDR

Microsoft Defender Experts MDR is a managed extended detection and response service that helps your SOC focus and accurately respond to incidents that matter. It provides coverage for customers who use Microsoft Defender services, including Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Microsoft Entra ID.

Key capabilities:

  • Focus on incidents that matter – Experts prioritize incidents and alerts, alleviate alert fatigue, and drive SOC efficiency for your team.
  • Manage response your way – Experts provide detailed, step-by-step, actionable guidance to respond to incidents with the option to act on your behalf as needed.
  • Access expertise when you need it – Extend your team's capacity with access to Defender Experts for assistance on an investigation.
  • Stay ahead of emerging threats – Experts proactively hunt for emerging threats in your environment, informed by unparalleled threat intelligence and visibility.

Learn more about Defender Experts MDR

Defender Experts Hunting

Microsoft Defender Experts Hunting is a proactive threat hunting service for customers who have a robust SOC but want Microsoft to help them proactively hunt threats using Microsoft Defender data.

Two standalone offerings are available:

  • Defender Experts Hunting - XDR – Proactive threat hunting that goes beyond the endpoint to hunt in endpoints, Microsoft 365, cloud applications, and identity.
  • Defender Experts Hunting - Servers – Proactive threat hunting for hybrid and multicloud servers.

Key capabilities:

  • Threat hunting and analysis – Experts look deeper to expose advanced threats and identify the scope and impact of malicious activity associated with human adversaries.
  • Defender Experts Notifications – Notifications show up as incidents in Microsoft Defender with specific information about scope, method of entry, and remediation instructions.
  • Ask Defender Experts – Get expert advice about threats your organization faces directly in the Microsoft Defender portal.
  • Hunter-trained AI – Experts share their learning back into automated tools to improve threat discovery and prioritization.
  • Reports – An interactive report summarizing what was hunted and what was found.

Learn more about Defender Experts Hunting.

Defender Experts for Servers

Microsoft Defender Experts for Servers is a managed extended detection and response service that provides expert-driven coverage for on-premises and multicloud servers protected by Microsoft Defender for Cloud. It covers server infrastructure in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

Key capabilities:

  • Focus on incidents that matter – Experts prioritize incidents and alerts related to your server workloads, reduce alert fatigue, and drive SOC efficiency.
  • Manage response your way – Experts provide actionable, step-by-step guidance to respond to incidents, with the option to act on your behalf.
  • Access expertise when you need it – Extend your team's capacity with access to Defender Experts for assistance on an investigation.
  • Stay ahead of emerging threats – Experts proactively hunt for emerging threats in your server environment, informed by unparalleled threat intelligence.

Learn more about Defender Experts for Servers.

Defender Experts Threat Intelligence

Microsoft Defender Experts Threat Intelligence is an expert-delivered service that provides ongoing threat briefings and proactive threat intelligence, giving you continuous, contextual, and actionable insights tailored to your organization. Seasoned threat intelligence experts filter and prioritize signals into curated intelligence aligned to your industry, geography, and environment, so your team knows what matters most and what actions to take.

Key capabilities:

  • Contextualized threat intelligence – Experts cut through the noise to surface what's most relevant to your organization and explain what it means for your environment, industry, geography, and evolving threat landscape.
  • Actionable intelligence delivered by experts – Designated experts provide clear, actionable recommendations, not just data, so your team can respond effectively when it matters most.
  • Insight for leaders and defenders – Executive-ready summaries support high-level decision-making, while deep technical detail, including MITRE-aligned tactics, techniques, and procedures (TTPs), supports hands-on security operations.
  • Proactive threat defense – Early visibility into evolving threats helps your team anticipate risks and act sooner.

Intelligence is delivered through monthly briefings tailored to your industry, geography, and organization, and through proactive threat alerts that provide early warning and peer threat insights. Built on Microsoft's global threat intelligence, the service tracks thousands of threat actors and campaigns to give you visibility into developing threats before they affect your environment.

Defender Experts Cybersecurity Incident Response

Microsoft Defender Experts Cybersecurity Incident Response is a professional service that helps your organization prepare for, respond to, and recover from cybersecurity incidents. It covers the entire incident lifecycle with both proactive and reactive support, and specializes in Microsoft 365, Azure, and Windows environments.

Key capabilities:

  • Prepare before an incident – Experts assess your readiness, review your security posture, and help build or improve incident response plans through tabletop exercises and attack simulations.
  • Respond during an incident – Experts triage the incident, contain and investigate active threats, perform digital forensics, and provide hands-on remediation guidance to remove the threat and restore critical services.
  • Recover after an incident – Experts deliver post-incident reporting, facilitate lessons-learned workshops, and support remediation and follow-up threat monitoring to help prevent reinfection.

This service requires a separate contract. For high-impact attacks such as ransomware or nation-state activity, it helps reduce downtime and limit damage.

Learn more about Microsoft Defender Experts Cybersecurity Incident Response.

How to get started

Each Defender Experts service is sold separately. To get started:

Service Next step
Defender Experts MDR Complete the customer interest form or learn about the Defender Experts Suite
Defender Experts Hunting Complete the customer interest form
Defender Experts for Servers Contact your Microsoft account representative
Defender Experts Threat Intelligence Contact your Microsoft account representative
Defender Experts Cybersecurity Incident Response Contact your Microsoft account representative

For prerequisites and setup instructions:

Related content

  • Last updated on