📘 Course Guide

Microsoft Defender XDR Administration: Complete Practical Course — Matching the Defender Portal & SC-200 Certification

✍️ Author: Techcareers
📂 Category: Microsoft Defender
👥 Audience: Security Administrators, SOC Analysts, SC-200 Candidates
📅 Last Reviewed: August 2026

This course guide maps directly to the Microsoft Defender portal (security.microsoft.com) — every blade in the unified XDR navigation is covered here as a practical module. Whether you are preparing for the SC-200: Microsoft Security Operations Analyst certification or administering a live Microsoft 365 Defender environment, this guide delivers hands-on knowledge for email threat protection, endpoint security, identity threat detection, cloud app security, advanced hunting with KQL, and vulnerability management.

The guide covers the complete Defender XDR stack — Incidents & Alerts, Threat Explorer, Anti-Phishing, Anti-Spam, Anti-Malware, Safe Links, Safe Attachments, Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Advanced Hunting (KQL), Vulnerability Management, and Threat Analytics — including the latest 2025–2026 updates: Microsoft Security Copilot integration, automatic attack disruption, and the unified SOC platform in Defender XDR.

🗺️ Course Module Map

Defender XDR Portal Overview

security.microsoft.com dashboard, unified XDR product lineup, attack disruption, Security Copilot

Incidents & Alerts

Incident queue, alert correlation, investigation workflow, automated investigation & response (AIR)

Email Threat Explorer & Submissions

Real-time detections, Threat Explorer views, user submissions, admin submission to Microsoft

Threat Policies — Anti-Phishing & Anti-Spam

Anti-phishing policy settings, impersonation protection, spoof intelligence, anti-spam filtering

Threat Policies — Safe Links & Safe Attachments

Safe Links URL detonation, Safe Attachments (Dynamic Delivery), anti-malware policy, quarantine

Microsoft Defender for Endpoint

Device onboarding, device inventory, endpoint alerts, response actions, endpoint policies

Microsoft Defender for Identity

Sensor deployment, identity alerts, lateral movement paths, ITDR, Active Directory health

Microsoft Defender for Cloud Apps

Cloud discovery, app governance, session policies, CASB, OAuth app controls

Advanced Hunting with KQL

Schema tables, query language basics, sample threat hunting queries across all XDR data sources

Vulnerability Management

Device exposure score, CVE inventory, remediation recommendations, software inventory

Threat Analytics & Reports

Threat analytics reports, built-in Defender reports, email security reports, attack simulation

SC-200 Certification Alignment

Exam domains, skill weightings, KQL tips, scenario-based study guidance

🏠 Module 1: Microsoft Defender XDR Portal Overview

The Microsoft Defender portal at security.microsoft.com is the unified Extended Detection and Response (XDR) platform consolidating all Microsoft security products into a single investigation and response console. It replaced the standalone portals for Defender for Office 365, Defender for Endpoint, Defender for Identity, and Defender for Cloud Apps.

Microsoft Defender XDR — Product Lineup

Product	Protects	Licence	Portal Section
Defender for Office 365 (MDO) P1	Email & collaboration (Exchange Online, Teams, SharePoint)	Microsoft 365 Business Premium, E3 + add-on, E5	Email & collaboration → Threat policies
Defender for Office 365 (MDO) P2	MDO P1 + Attack Simulation, Threat Tracker, Campaign Views, AIR	Microsoft 365 E5, M365 Defender	Email & collaboration → Attack simulation training
Defender for Endpoint (MDE) P1	Endpoints — attack surface reduction, next-gen antivirus, device control	Microsoft 365 E3, Business Premium	Endpoints → Configuration management
Defender for Endpoint (MDE) P2	MDE P1 + EDR, threat hunting, device timeline, auto-investigation	Microsoft 365 E5, Defender for Endpoint P2	Endpoints → Device inventory, Vulnerabilities
Defender for Identity (MDI)	On-premises Active Directory / AD DS — identity threat detection	Microsoft 365 E5, Microsoft Defender for Identity	Identities → Overview, Health issues
Defender for Cloud Apps (MDA)	SaaS applications — CASB, app discovery, session control	Microsoft 365 E5, Cloud App Security	Cloud apps → Cloud discovery

🏠 Home
🚨 Incidents & alerts
⚛️ Actions & submissions
📊 Threat intelligence
💻 Endpoints
💌 Email & collaboration
☁️ Cloud apps
👤 Identities
🔎 Hunting

💡 Automatic Attack Disruption — 2025–2026 Key Feature

Microsoft Defender XDR’s Automatic Attack Disruption uses AI to correlate signals across endpoints, email, identity, and cloud apps to automatically contain active attacks — without waiting for analyst action. When a business email compromise (BEC) or ransomware attack is detected mid-execution, Defender XDR can automatically isolate the compromised device, disable the compromised user account, and block the attacker’s lateral movement within seconds. This is a heavily-tested SC-200 topic.

🚨 Module 2: Incidents & Alerts

The Incidents queue is the primary working surface for security analysts. Microsoft Defender XDR automatically correlates individual alerts from across all Defender products into unified incidents — grouping related alerts from email, endpoint, identity, and cloud app signals that are part of the same attack chain into a single incident for cohesive investigation.

Incident Properties & Triage Fields

Field	Description	Values
Severity	Highest alert severity within the incident — automatically calculated	High, Medium, Low, Informational
Status	Investigation lifecycle stage	New, In progress, Resolved
Classification	Outcome after investigation — whether the incident was a real attack	True positive, False positive, Informational expected
Determination	Specific classification sub-type	Malware, Phishing, Unwanted software, Security test, Other
Assigned to	Analyst responsible for investigating this incident	SOC analyst name or team queue
Tags	Custom labels for grouping related incidents — useful for campaign tracking	Free-text — e.g. “Operation BEC-2026”, “Ransomware-Wave-3”
Attack techniques	MITRE ATT&CK framework techniques observed in the incident	T1566 (Phishing), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact)

Query Incidents & Alerts via Microsoft Graph Security API

Retrieve open high-severity incidents, list alerts for a specific incident, and update incident classification and status programmatically for SOC automation workflows.

Microsoft Graph PowerShell (Security API)

Connect-MgGraph -Scopes "SecurityIncident.ReadWrite.All","SecurityAlert.ReadWrite.All"

# Get all high-severity open incidents
Get-MgSecurityIncident -Filter "severity eq 'high' and status eq 'active'" -All |
  Select-Object Id,DisplayName,Severity,Status,CreatedDateTime,LastUpdateDateTime,AssignedTo |
  Sort-Object CreatedDateTime -Descending |
  Format-Table -AutoSize

# Get all alerts for a specific incident
$IncidentId = "incident-id-here"
Get-MgSecurityIncidentAlert -IncidentId $IncidentId |
  Select-Object Id,Title,Severity,Category,ServiceSource,CreatedDateTime |
  Format-Table -AutoSize

# Update incident status and classification after investigation
Update-MgSecurityIncident -IncidentId $IncidentId `
  -Status "resolved" `
  -Classification "truePositive" `
  -Determination "malware" `
  -AssignedTo "analyst@contoso.com"
Write-Host "Incident resolved and classified."

💌 Module 3: Email Threat Explorer & Submissions

Threat Explorer (MDO P2) and Real-time detections (MDO P1) are the primary email investigation tools — they provide near-real-time visibility into every email processed by Exchange Online, with filtering by sender, recipient, URL, attachment, detection technology, and delivery status.

Threat Explorer Views

View	Shows	Use For
All email	Every inbound and outbound email with full metadata — detection technology, delivery location, threats detected	General email investigation; trace a specific sender or recipient
Malware	Emails with malware detections — file hash, malware family, safe attachment detonation results	Malware outbreak investigation; identify all recipients of a malicious attachment
Phish	Emails classified as phishing — URL analysis, spoof detection, impersonation, phishing confidence	Phishing campaign tracking; identify compromised accounts that clicked phishing links
Campaigns	Clustered phishing or malware campaigns — groups related emails by sender infrastructure and payload	Campaign-level threat intelligence; understand the full scope of an attack wave
URL clicks	Safe Links clicks — shows which users clicked which URLs, verdict at click time, block/allow outcome	Identify users who clicked malicious links; post-breach URL click investigation

Investigate Email Threats & Submit False Positives/Negatives

Use Exchange Online PowerShell to trace suspicious emails, identify all recipients of a known-malicious message, and submit emails to Microsoft for analysis.

Exchange Online PowerShell (Email Investigation)

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Trace all emails from a suspicious sender domain (last 10 days)
Get-MessageTrace `
  -SenderAddress "*@suspicious-domain.com" `
  -StartDate (Get-Date).AddDays(-10) `
  -EndDate (Get-Date) |
  Select-Object Received,SenderAddress,RecipientAddress,Subject,Status,MessageId |
  Export-Csv -Path "SuspiciousSenderTrace.csv" -NoTypeInformation

# Get detailed delivery events for a specific message
Get-MessageTraceDetail -MessageTraceId "message-trace-id" -RecipientAddress "victim@contoso.com" |
  Select-Object Date,Event,Action,Detail |
  Format-Table -AutoSize

# Find all recipients of a known-bad phishing message
$Recipients = Get-MessageTrace `
  -SenderAddress "attacker@phishing.com" `
  -StartDate (Get-Date).AddDays(-3) -EndDate (Get-Date) |
  Where-Object {$_.Status -eq "Delivered"} |
  Select-Object -ExpandProperty RecipientAddress
Write-Host "Delivered to $($Recipients.Count) recipients"

🔒 Module 4: Threat Policies — Anti-Phishing & Anti-Spam

Threat policies are configured under Email & collaboration → Policies & rules → Threat policies. They define the filtering rules applied to all mail flow through Exchange Online Protection (EOP) — included in all M365 plans — and the enhanced protections from Defender for Office 365 (MDO P1/P2).

Anti-Phishing Policy Key Settings

Setting	Description	Recommended (Standard)
Phishing email threshold	Aggressiveness of phishing detection — 1 (standard) to 4 (most aggressive)	3 (More aggressive) for high-value targets; 2 for general users
Enable mailbox intelligence	Learns user-specific communication patterns to detect impersonation	On — significantly reduces false positives on legitimate senders
Enable spoof intelligence	Detects spoofed senders using email authentication (SPF, DKIM, DMARC) analysis	On — always enable; quarantine action for unauthenticated senders
User impersonation protection	Protect specific high-value users (executives) from impersonation — MDO P1/P2	Add CEO, CFO, board members; quarantine action on detection
Domain impersonation protection	Protect owned and commonly spoofed domains from look-alike attacks — MDO P1/P2	Add all owned domains + commonly-spoofed partner domains
Action on phishing detection	What happens to detected phishing emails	Quarantine message (preferred over Junk folder for phishing)

Configure Anti-Phishing & Anti-Spam Policies

Review and harden the default anti-phishing policy, set phishing threshold aggressiveness, configure spoof intelligence, and audit anti-spam policy bulk thresholds.

Exchange Online PowerShell (Threat Policies)

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get all anti-phishing policies
Get-AntiPhishPolicy | Select-Object Name,IsDefault,PhishThresholdLevel,EnableMailboxIntelligence,EnableSpoofIntelligence | Format-Table -AutoSize

# Harden the default anti-phishing policy
Set-AntiPhishPolicy -Identity "Office365 AntiPhish Default" `
  -PhishThresholdLevel 3 `
  -EnableMailboxIntelligence $true `
  -EnableMailboxIntelligenceProtection $true `
  -MailboxIntelligenceProtectionAction Quarantine `
  -EnableSpoofIntelligence $true `
  -AuthenticationFailAction Quarantine `
  -EnableFirstContactSafetyTips $true

# Get anti-spam policies
Get-HostedContentFilterPolicy | Select-Object Name,IsDefault,SpamAction,HighConfidenceSpamAction,BulkThreshold | Format-Table -AutoSize

# Harden the default anti-spam policy
Set-HostedContentFilterPolicy -Identity "Default" `
  -SpamAction MoveToJmf `
  -HighConfidenceSpamAction Quarantine `
  -PhishSpamAction Quarantine `
  -BulkThreshold 6 `
  -QuarantineRetentionPeriod 30

# Get spoof intelligence — who is currently spoofing your domains
Get-TenantAllowBlockListSpoofItems | Select-Object SpoofedUser,SendingInfrastructure,SpoofType,Action | Format-Table -AutoSize

🔗 Module 5: Threat Policies — Safe Links, Safe Attachments & Anti-Malware

Safe Links and Safe Attachments are MDO P1/P2 features that provide time-of-click URL protection and attachment sandboxing. They go beyond EOP’s signature-based scanning by actively detonating URLs and attachments in a sandbox environment to detect zero-day threats.

Safe Links vs Safe Attachments

Feature	Safe Links	Safe Attachments
What it protects	URLs in email body, Teams messages, and Office documents — rewrites and checks at click time	Email attachments — detonates in sandbox before delivery to user
When it activates	At time of click — even if URL was clean at delivery, Safe Links re-checks it when the user clicks	Before delivery — message held for sandbox analysis (can delay delivery)
Dynamic Delivery	N/A	Yes — delivers email body immediately with placeholder attachment; replaces when scan completes
Applies to	Exchange Online email, Microsoft Teams, Office apps (requires Defender for Office 365 app integration)	Exchange Online email, SharePoint, OneDrive, Microsoft Teams files
Verdict action	Block URL access if malicious; redirect to warning page	Block (delete), Replace (remove attachment + notify), Dynamic Delivery

Configure Safe Links, Safe Attachments & Anti-Malware Policies

Review and configure Safe Links, Safe Attachments, and anti-malware policies using Exchange Online PowerShell, and manage the Tenant Allow/Block List for custom overrides.

Exchange Online PowerShell (MDO Threat Policies)

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get Safe Links policies
Get-SafeLinksPolicy | Select-Object Name,EnableSafeLinksForEmail,EnableSafeLinksForTeams,ScanUrls,DeliverMessageAfterScan,AllowClickThrough | Format-Table -AutoSize

# Create a hardened Safe Links policy
New-SafeLinksPolicy -Name "Standard Safe Links" `
  -EnableSafeLinksForEmail $true `
  -EnableSafeLinksForTeams $true `
  -ScanUrls $true `
  -DeliverMessageAfterScan $true `
  -AllowClickThrough $false `
  -TrackClicks $true

# Get Safe Attachments policies
Get-SafeAttachmentPolicy | Select-Object Name,Enable,Action,Redirect,ActionOnError | Format-Table -AutoSize

# Create Safe Attachments policy with Dynamic Delivery
New-SafeAttachmentPolicy -Name "Standard Safe Attachments" `
  -Enable $true `
  -Action DynamicDelivery `
  -ActionOnError $false

# Block a malicious sender and URL in the Tenant Allow/Block List
New-TenantAllowBlockListItems -ListType Sender -Block -Entries "*@malicious-domain.com" -NoExpiration
New-TenantAllowBlockListItems -ListType Url -Block -Entries "malicious-site.com" -NoExpiration

# List all current block entries
Get-TenantAllowBlockListItems -ListType Sender | Format-Table -AutoSize

💻 Module 6: Microsoft Defender for Endpoint

Microsoft Defender for Endpoint (MDE) provides endpoint detection and response (EDR) capabilities — collecting security telemetry from every onboarded device, correlating it with threat intelligence, and enabling automated investigation and response. Devices must be onboarded to MDE before they are protected and visible in the Defender portal.

MDE Onboarding Methods by Platform

Platform	Onboarding Method	Managed Via
Windows 10/11	Microsoft Intune (MDM), Group Policy, Configuration Manager (SCCM/MEM), Local script, VDI onboarding	Intune → Endpoint security → Endpoint detection and response
Windows Server 2016+	Microsoft Monitoring Agent (MMA), Defender for Endpoint unified agent, Azure Arc	Defender for Cloud (MDE server plan) + Azure Arc
macOS	Intune MDM profile, Jamf, manual package deployment	Intune or Jamf → deploy MDE macOS package
Linux	Bash script, Puppet, Ansible, Chef configuration management	Script-based or config management tool
iOS / Android	Microsoft Intune app deployment (mobile threat defence)	Intune → Apps → Deploy Microsoft Defender

Manage Defender for Endpoint Devices & Response Actions

Query the MDE device inventory, isolate a compromised device from the network, run an antivirus scan, and collect investigation package for forensic analysis.

Microsoft Graph PowerShell (Defender for Endpoint)

Connect-MgGraph -Scopes "Machine.ReadWrite.All","Alert.ReadWrite.All"

# Get all MDE-onboarded devices with risk scores
Invoke-MgGraphRequest -Method GET `
  "https://api.securitycenter.microsoft.com/api/machines" |
  Select-Object -ExpandProperty value |
  Select-Object computerDnsName,osPlatform,healthStatus,riskScore,onboardingStatus,lastSeen |
  Sort-Object riskScore -Descending |
  Export-Csv -Path "MDEDeviceInventory.csv" -NoTypeInformation

# Isolate a compromised device (full network isolation)
$MachineId = "machine-id-here"
Invoke-MgGraphRequest -Method POST `
  "https://api.securitycenter.microsoft.com/api/machines/$MachineId/isolate" `
  -Body @{ IsolationType = "Full"; Comment = "Isolated during ransomware investigation - INC001" }

# Run antivirus scan on a device
Invoke-MgGraphRequest -Method POST `
  "https://api.securitycenter.microsoft.com/api/machines/$MachineId/runAntiVirusScan" `
  -Body @{ ScanType = "Quick"; Comment = "Post-incident remediation scan" }

# Get all active high/medium severity MDE alerts
Invoke-MgGraphRequest -Method GET `
  "https://api.securitycenter.microsoft.com/api/alerts?`$filter=severity in ('High','Medium') and status ne 'Resolved'" |
  Select-Object -ExpandProperty value |
  Select-Object title,severity,status,machineId,firstEventTime |
  Sort-Object firstEventTime -Descending |
  Format-Table -AutoSize

👤 Module 7: Microsoft Defender for Identity

Microsoft Defender for Identity (MDI) monitors on-premises Active Directory Domain Services for identity-based attacks — lateral movement, credential theft, domain dominance, and reconnaissance techniques. It deploys lightweight sensors on domain controllers that send AD security events and network traffic metadata to the Defender XDR cloud for analysis.

Key MDI Alert Categories

Category	Alert Examples	MITRE Technique
Reconnaissance	Account enumeration recon, LDAP enumeration, network mapping, user and IP address recon	T1087 Account Discovery, T1046 Network Service Scanning
Credential access	Suspected Brute Force attack (Kerberos, NTLM), Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket	T1558 Steal or Forge Kerberos Tickets, T1110 Brute Force
Lateral movement	Remote code execution attempt (WMI, PowerShell), suspected use of PsExec, RDP hijacking, overpass-the-hash	T1021 Remote Services, T1550 Use Alternate Auth
Domain dominance	DCSync attack, Skeleton Key malware, Golden Ticket usage, DC Shadow, AdminSDHolder modification	T1003 OS Credential Dumping, T1484 Domain Policy Modification
Exfiltration	DNS tunnel detected, suspected data exfiltration over SMB	T1048 Exfiltration Over Alternative Protocol

💡 MDI Sensor Deployment — Key Requirements

MDI sensors should be deployed on all domain controllers, including read-only domain controllers (RODCs) and AD FS servers. The sensor runs as a Windows service and requires: Windows Server 2016+, .NET Framework 4.7+, minimum 6GB RAM dedicated, and network access from the DC to the Defender portal endpoints on TCP 443. After sensor installation, configure the Directory Service Account — a dedicated AD account with read-only access to the domain — that the sensor uses to query AD for user, group, and device context.

☁️ Module 8: Microsoft Defender for Cloud Apps

Microsoft Defender for Cloud Apps (MDA) is a Cloud Access Security Broker (CASB) that provides visibility into sanctioned and unsanctioned cloud app usage, data-in-motion protection, session controls for real-time policy enforcement, and OAuth app governance across your tenant.

MDA Key Capabilities

Capability	Description	Licence
Cloud Discovery / Shadow IT	Analyses firewall/proxy logs to identify all cloud apps in use — risk scores 1–10 per app, identifies unsanctioned usage	MDA included in M365 E5
App governance	Monitors OAuth apps connected to M365 — identifies overprivileged apps, consent grant abuse, unusual app behaviour	MDA — App governance add-on (now included in E5)
Session policies (Conditional Access App Control)	Real-time inline session control for sanctioned apps — block download, watermark content, block paste, monitor session	MDA → requires reverse proxy routing via Defender
Anomaly detection policies	ML-based detection of impossible travel, mass download, unusual admin activity, suspicious OAuth app activity	MDA — built-in, always-on after onboarding
File policies	DLP for cloud storage — detect and respond to sensitive data exposed in SharePoint, OneDrive, Teams, Box, Google Drive	MDA → integrates with Purview sensitivity labels

🔎 Module 9: Advanced Hunting with KQL

Advanced Hunting in Microsoft Defender XDR provides a unified query interface across all XDR data sources — endpoints, email, identity, and cloud apps — using Kusto Query Language (KQL). Data is retained for 30 days by default (up to 180 days with Defender XDR long-term retention).

Key Advanced Hunting Schema Tables

Table	Data Source	Key Use Case
EmailEvents	Defender for Office 365	Email metadata: sender, recipient, subject, delivery action, threat types detected
EmailUrlInfo	Defender for Office 365	URLs extracted from emails — join with EmailEvents for phishing URL investigation
DeviceProcessEvents	Defender for Endpoint	Process creation on endpoints — detect suspicious process launches, LOLBins
DeviceNetworkEvents	Defender for Endpoint	Network connections from devices — detect C2 communication, data exfiltration
DeviceFileEvents	Defender for Endpoint	File create/modify/delete/rename — detect ransomware file encryption patterns
IdentityLogonEvents	Defender for Identity	AD authentication events — lateral movement, credential spray, Kerberos anomalies
CloudAppEvents	Defender for Cloud Apps	Activity in sanctioned cloud apps — mass downloads, unusual admin activity
AlertEvidence	All XDR sources	Evidence entities (files, IPs, URLs, users) associated with each alert

Advanced Hunting — Sample Threat Hunting Queries

Ready-to-run KQL queries for the most common threat hunting scenarios across email, endpoint, and identity data sources in Microsoft Defender XDR.

KQL — Advanced Hunting (Microsoft Defender XDR)

// 1. Find phishing emails delivered to users in last 7 days
EmailEvents
| where Timestamp > ago(7d)
| where ThreatTypes has "Phish"
| where DeliveryAction == "Delivered"
| summarize DeliveredCount = count() by SenderFromDomain, SenderIPv4, RecipientEmailAddress
| sort by DeliveredCount desc

// 2. Users who clicked malicious URLs (Safe Links)
UrlClickEvents
| where Timestamp > ago(7d)
| where ActionType == "ClickBlocked" or ThreatTypes has_any ("Phish", "Malware")
| summarize ClickCount = count() by AccountUpn, Url, IsClickedThrough
| sort by ClickCount desc

// 3. Detect suspicious PowerShell (encoded commands, downloader)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "powershell.exe" or FileName =~ "pwsh.exe"
| where ProcessCommandLine has_any (
    "-enc", "-EncodedCommand", "bypass",
    "WebClient", "DownloadString", "IEX"
  )
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| sort by Timestamp desc

// 4. Detect mass file renames (ransomware indicator)
DeviceFileEvents
| where Timestamp > ago(1h)
| where ActionType == "FileRenamed"
| summarize RenamedFiles = count() by DeviceName, AccountName, bin(Timestamp, 5m)
| where RenamedFiles > 50
| sort by RenamedFiles desc

// 5. Detect lateral movement via PsExec
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "services.exe"
| where FileName =~ "PSEXESVC.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine

📊 Module 10: Vulnerability Management

Microsoft Defender Vulnerability Management (MDVM) — accessible under Endpoints → Vulnerability management — provides continuous CVE discovery, risk-based prioritisation, and remediation tracking for every onboarded device. It uses the Microsoft Exposure Score and per-device Risk Score to help security teams prioritise which vulnerabilities to remediate first based on actual exploit activity in the wild.

Vulnerability Management Key Views

View	What It Shows	Key Metric
Dashboard	Exposure score (0–100, lower is better), top security recommendations, top vulnerable devices	Exposure score — track weekly trend; aim to reduce by 5+ points per quarter
Recommendations	Prioritised list of security configuration improvements — update software, change settings, apply patches	Exposed devices count + remediation impact score
Weaknesses (CVEs)	Full CVE inventory for all onboarded devices — CVSS score, exploit available flag, exposed device count	Filter by “Exploit available” + severity “Critical” for immediate action
Software inventory	Every installed software title and version across all devices — identifies EOL software and missing patches	EOL software count — highest risk category requiring urgent action
Remediation	Submitted remediation tasks with status tracking — integrates with Intune and SCCM for automated patching	Open remediation tasks by age — SLA tracking

📊 Module 11: Threat Analytics & Reports

Threat Analytics — in the Threat intelligence section — provides curated threat intelligence reports from Microsoft’s security research team, covering active threat actors, malware families, and campaign analysis. Each report shows how your organisation’s current exposure maps to the described threat, including impacted assets and recommended mitigations.

Run Email Security Reports & Attack Simulation

Pull built-in Defender for Office 365 email security reports using PowerShell and set up Attack Simulation Training to measure user susceptibility to phishing campaigns.

Exchange Online PowerShell (MDO Reports)

Connect-ExchangeOnline -UserPrincipalName admin@contoso.com

# Get mail traffic summary (last 7 days)
Get-MailTrafficSummaryReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Category,Total | Format-Table -AutoSize

# Get MDO protection report (malware + phishing detections)
Get-MailTrafficATPReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Select-Object Date,Direction,EventType,MessageCount |
  Sort-Object Date -Descending | Format-Table -AutoSize

# Get Safe Links click verdicts (last 30 days) — export blocked clicks
Get-SafeLinksDetailReport -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) |
  Where-Object {$_.Verdict -ne "Allowed"} |
  Export-Csv -Path "SafeLinksClicks.csv" -NoTypeInformation

# Get top malware families detected in email (last 7 days)
Get-MailDetailMalwareReport -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) |
  Group-Object FileName |
  Select-Object Name,Count |
  Sort-Object Count -Descending -First 10 |
  Format-Table -AutoSize

🎓 Module 12: SC-200 Certification Alignment

The SC-200: Microsoft Security Operations Analyst certification validates your ability to use Microsoft security products to detect, investigate, and respond to threats across the Defender XDR platform, Microsoft Sentinel, and Microsoft Defender for Cloud.

🎍 SC-200: Microsoft Security Operations Analyst Associate

35%

Mitigate Threats Using Microsoft Defender XDR

Incident investigation, email threat hunting (Threat Explorer), endpoint response actions (isolate, AV scan), identity threat detection (MDI alerts, lateral movement), CASB (MDA), Advanced Hunting KQL — Modules 1–9

30%

Mitigate Threats Using Microsoft Sentinel

Workspace configuration, data connectors, Analytics rules, Workbooks, Playbooks (Logic Apps automation), UEBA, threat hunting in Sentinel — (See dedicated Microsoft Sentinel course)

20%

Mitigate Threats Using Microsoft Defender for Cloud

Security posture (Secure Score), Defender for Cloud workload protections (servers, storage, databases), regulatory compliance, Defender CSPM — (Azure-focused; covered in AZ-500)

15%

Manage a Secure Cloud Environment

Defender for Cloud Apps CASB policies, app governance, data security posture, Microsoft Purview integration with Defender XDR — Module 8

✅ SC-200 Exam Study Tips

Know MDO P1 vs P2 features precisely — P1 adds Safe Links, Safe Attachments, Anti-phishing with impersonation; P2 adds Attack Simulation Training, Threat Trackers, Campaign Views, and Automated Investigation & Response (AIR)
Understand EOP vs MDO filtering layers — EOP (included free) provides anti-spam, anti-malware, connection filtering; MDO P1 adds Safe Links and Safe Attachments on top; know that EOP cannot be disabled even with MDO P2
Study KQL query structure thoroughly — the SC-200 exam includes scenario questions requiring you to identify the correct Advanced Hunting table and query operators; know where, summarize, project, sort, join, has, has_any, ago(), bin()
Know the Automatic Attack Disruption scenarios — ransomware and BEC are the two primary scenarios; understand that AIR can automatically isolate devices and disable users without analyst approval when confidence is high
Understand MDI sensor types — the sensor runs directly on domain controllers (preferred) or on standalone servers with network traffic mirroring; know that the Directory Service Account needs only read-only access to AD
Practice KQL in the Defender portal using the Go Hunt capability on individual alerts and entities — this generates a starting KQL query that you can study and modify

💡 Best Practices Summary

Apply Preset security policies (Standard or Strict protection) in Defender for Office 365 before creating custom policies — Microsoft’s preset policies are continuously tuned with current threat intelligence
Enable Dynamic Delivery in Safe Attachments — it delivers the email body immediately while scanning the attachment, eliminating user complaints about email delivery delays
Set AllowClickThrough = $false in Safe Links policies — users should never be able to bypass a Safe Links block regardless of urgency; security training, not click-through, is the right response
Configure DMARC, DKIM, and SPF for all sending domains — email authentication is the foundation of anti-spoofing; without DMARC enforcement, spoof intelligence can only detect, not block, spoofed emails
Use Attack Simulation Training monthly — target users who clicked in previous simulations with more frequent training; track the click rate trend as your primary security awareness KPI
Review the Vulnerability Management exposure score weekly — set a target to reduce by 5–10 points per quarter; focus first on Critical CVEs with public exploits on devices with High or Very High risk scores
Create custom detection rules in Advanced Hunting for your highest-priority threats — custom detections run continuously and generate alerts when the query returns results, acting as persistent threat hunting logic
Integrate Microsoft Defender XDR with Microsoft Sentinel via the Defender XDR connector for long-term log retention and cross-platform correlation beyond the 30-day hunting window

📚 References & Further Reading

🔗 Microsoft Defender XDR Documentation — Microsoft Learn
🔗 SC-200: Security Operations Analyst Certification — Microsoft Learn
🔗 Defender for Office 365 Overview — Microsoft Learn
🔗 Onboard Devices to Defender for Endpoint — Microsoft Learn
🔗 Microsoft Defender for Identity Overview — Microsoft Learn
🔗 Advanced Hunting in Microsoft Defender XDR — Microsoft Learn
🔗 Microsoft Defender Portal — security.microsoft.com