Threat protection built into Microsoft 365.
Microsoft Defender protects devices, email and collaboration tools from malware, phishing and ransomware. We deploy it, tune it and watch the alerts.
What Microsoft Defender covers
What is Microsoft Defender?
Microsoft Defender is a family of security tools included in many Microsoft 365 plans. Defender for Business protects Windows, Mac and mobile devices from ransomware and malware. Defender for Office 365 protects email and Teams from phishing, malicious links and dangerous attachments.
The Defender portal brings alerts from these tools together, so incidents that span a device, a mailbox and a user account can be investigated as one story rather than as separate alarms.
The tools are strong, but their value depends on configuration. Default policies are conservative, and many protections, such as Safe Links and attack surface reduction rules, need to be switched on and tuned.
Defender is best understood as a stack. At the bottom are protections on each device. Above that are protections for email and collaboration, and on top is the Defender portal, where alerts from all of these are correlated into incidents.
The result is that a suspicious email, the user who clicked it and the device that ran the file are connected in one investigation, rather than arriving as three unrelated alerts in three tools.
What Microsoft Defender can do.
Next generation antivirus
Behaviour and cloud based detection for malware and ransomware on Windows, macOS, Linux and mobile.
Endpoint detection and response
Records what happens on a device so attacks can be investigated and contained.
Attack surface reduction
Rules that block risky behaviours such as Office apps launching scripts or credential theft.
Safe Links and Safe Attachments
Links are checked when clicked and attachments are opened in a safe environment before delivery.
Anti-phishing and impersonation protection
Detects spoofing and lookalike senders, including executives and trusted partners.
Automated investigation and response
Defender can investigate alerts and remediate threats without waiting for a person.
Vulnerability management
Shows software weaknesses and missing patches on devices, ranked by risk.
Microsoft Secure Score
A measurable score with recommended actions to improve your configuration.
How Microsoft Defender works.
Prevent
Policies block malicious attachments, links and risky behaviour before they run.
Detect
Defender watches devices, email and sign ins for suspicious activity.
Investigate
Alerts are grouped into incidents with a timeline of what happened.
Respond
Devices can be isolated, files removed and accounts locked, automatically or by our team.
What happens behind the scenes.
Defender for Business installs a sensor on each device, usually deployed through Intune. The sensor sends security signals to the cloud, where Microsoft’s detection engines analyse them. When a threat is found, the device can be isolated and the malicious files removed.
Defender for Office 365 sits in the mail flow. Messages are scanned before delivery for spam, phishing and malware. Safe Links rewrites URLs so they can be checked at the moment of click, and Safe Attachments detonates files in a sandbox. The portal then ties these events together.
How it benefits your business.
Defender reduces the likelihood and the damage of ransomware and phishing, the two threats that most often disrupt small and mid sized businesses. Because it is built into Microsoft 365, you get serious protection without adding separate tools for each layer.
It also improves visibility. Instead of discovering a problem after the damage is done, you see unusual behaviour as an incident with a timeline, and can contain it in minutes.
Many businesses already own Defender through their licence but have not turned it on or tuned it. Making full use of what you pay for is one of the fastest ways to improve security at no extra licence cost.
The benefits at a glance.
Ransomware protection
Behaviour based detection stops attacks that signature antivirus misses.
Phishing protection in email and Teams
Safe Links and Safe Attachments check content when it is opened.
One place to investigate
Incidents combine device, email and identity signals.
Already part of your licence
Many businesses pay for Defender without using it.
Automated response
Contain a compromised device quickly.
Reporting for insurers and clients
Evidence of security controls in place.
Licensing: Defender for Business and Defender for Office 365 Plan 1 are in Business Premium. Higher tiers are in E3 and E5. Plans and features change, so we confirm current licensing with you before you buy.
What this looks like day to day.
An employee receives an email with a link that looks like a shared document. Safe Links checks the destination at click time and blocks the page as malicious. The same message is removed from other inboxes automatically, and the incident appears in the Defender portal with a list of who received it.
This is an illustrative example of how the feature is used, not a description of a specific client.
Mistakes we see, and how we avoid them.
Default policies only
Out of the box protection is basic. Strict presets, Safe Links and ASR rules often need to be enabled and tuned.
Alerts nobody reads
Detection is only useful if someone responds. Alerts need an owner, or a managed service watching them.
Conflicting antivirus
Running two antivirus products can cause problems. Migrations should be planned.
Ignoring Secure Score
Recommendations sit untouched. Regular review turns them into real improvement.
Microsoft Defender with Infinity.
Defender for Business deployment
Roll out through Intune with tuned policies and exclusions.
Learn moreDefender for Office 365 policies
Anti-phishing, Safe Links, Safe Attachments and impersonation protection.
Learn moreAttack surface reduction
Rules that block common attack techniques on Windows.
Learn moreAlert monitoring
Our team reviews alerts, and we can add 24/7 managed detection and response.
Learn moreSecurity reviews
Secure Score and recommendations reviewed and acted on.
Learn moreIncident response
Containment and clean up when something gets through.
Learn moreIs Microsoft Defender the same as Windows Defender?
Windows Defender was the old name of the built in antivirus. Microsoft Defender for Business and the related tools add management, detection and response.
Is Defender good enough on its own?
It is a strong foundation. For round the clock monitoring, many businesses add a managed detection and response service, which we also provide.
Which plans include it?
Defender for Business and Defender for Office 365 Plan 1 are included with Business Premium. E3 and E5 include higher levels. We confirm current licensing.
Do we still need email filtering?
Defender for Office 365 helps a lot. Some businesses add a second layer, and we advise based on your risks.
Can you monitor the alerts?
Yes. Our team reviews alerts and can pair Defender with a managed SOC.
Talk to us about Microsoft Defender.
Book a free consultation. We will look at your current setup and show you where it fits.
Tell us about your IT.
We answer almost every inquiry within one business day.