Edit

Get started with Microsoft Defender Experts for XDR

  • Article
  • 2 minutes to read

Applies to:

Important

Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

Once the Defender Experts for XDR team is ready to onboard you, we'll reach out to get you started.

Activate your trial license

  1. Select the link in the welcome email to go directly to the Defender Experts settings page in the Microsoft 365 Defender portal. You can also open this page by going to Settings > Defender Experts.
  2. Read the Defender Experts for XDR preview terms and conditions then select Accept to accept them.
  3. Get your free license in Microsoft 365 admin center. In the checkout page, select Place order.

Grant permissions to our experts

By default, Defender Experts for XDR requires the following permissions to investigate incidents and notify you when you need to take action:

  • Service provider access - This permission lets our experts sign in to your tenant and deliver services based on assigned security roles. For details, learn more about cross-tenant access.
  • Security reader - This built-in Azure Active Directory (Azure AD) role lets our experts investigate incidents and provide guidance on necessary response actions.

You can also provide our experts the following permissions to investigate incidents on your behalf:

  • Security operator (recommended) - In addition to the permissions provided to a security reader, this built-in Azure AD role lets our experts take necessary actions to remediate active threats.
  • Security administrator (optimal) - In addition to the permissions provided to a security operator, this built-in Azure AD role lets our experts configure security settings and deploy preventive measures.

Learn more about Azure AD roles and permissions

Follow these steps to grant our experts additional permissions:

  1. In the same Defender Experts settings page mentioned earlier, select Manage permissions.
  2. Under Additional permissions, select the other role(s) you want to grant.
  3. Select Give access.

Important

If you skip providing additional permissions, our experts won't be able to take certain response actions to secure your network.

Go to the next step

Start using Microsoft Defender Experts for XDR preview service