The CISO's Guide to Microsoft Defender XDR: Investment Priorities and Quick Wins

Exploitation is the most common way an intrusion starts. Verizon's 2026 Data Breach Investigations Report puts it at 31% of breaches, the first time in 19 years that exploitation passed stolen credentials as the top entry point. Mandiant's M-Trends 2026 reports that exploits led for the sixth year in a row, at 32% of intrusions.

What the attacker does after the first foothold depends on identity. M-Trends describes attackers harvesting long-lived OAuth tokens and session cookies, and UNC3944 targeting IT help desks to bypass MFA. Ransomware operators targeted identity services along with backup infrastructure.

The time to respond is short. In 2022, the median time between initial access and hand-off to a secondary threat group was more than 8 hours. In 2025 it was 22 seconds. That is a median hand-off interval, not the length of an attack. Any response that waits for a person to open the alert is measured against that window.

Email phishing is a smaller share of intrusions than exploitation (6% of intrusions in 2025, per M-Trends 2026), and attackers use AI to raise what each campaign yields. Microsoft's EMEA newsroom summary of the Digital Defense Report 2025 reports a 54% click-through rate on AI-enhanced phishing, 4.5 times the rate of traditional methods, and a 195% increase in AI-generated IDs used to bypass identity verification.

Those numbers set the funding order for Defender XDR: coverage first, starting with identity; automated response second; the operations that run the queue third, including the AI that now ships with Microsoft 365 E5 and E7. Quick wins follow, and most of them use entitlements you already hold.

Intrusion timeline illustrating four stages of a cyber attack—Initial Access, Identity Use, Hand-off, and Impact—alongside corresponding defender control measures like endpoint coverage and attack disruption, highlighting the critical hand-off window reduction to 22 seconds by 2026.

What you already own

Defender XDR correlates signals from endpoints, identities, email and collaboration tools, and SaaS apps into incidents. 4 products supply those signals: Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps.

Microsoft Learn lists the licenses that give access to Defender features at no additional cost, including Microsoft 365 E5, Microsoft 365 E3 with the Microsoft Defender Suite add-on, Microsoft 365 Business Premium, Microsoft Defender for Business, and each of the 4 products on its own (Defender for Office 365 as Plan 2). The Billing admin role or higher shows what your tenant holds.

I worked with a client who didn't realize their security needs could be met with Defender for Cloud Apps. They held the entitlement under their current Microsoft 365 E5 licensing and had never deployed it.

A license that was never deployed produces no signal, and a request for new spend that ignores it is a request to pay twice. Start with an inventory.

Workload	Signal it contributes	What the SOC can't see without it
Defender for Endpoint	Device activity	Devices that aren't onboarded
Defender for Identity	Domain controller and Active Directory activity	Attacks on on-premises accounts
Defender for Office 365	Email and collaboration activity	Phishing and malicious attachments in mail
Defender for Cloud Apps	SaaS app activity	Apps with no connector

Diagram illustrating Microsoft's Defender XDR system, which consolidates signals from four critical workloads—Endpoint, Identity, Office 365, and Cloud Apps—into a single incident queue. The system provides two action exits: an automated action for high-confidence incidents and an analyst review for further examination.

View of the Microsoft 365 admin center showing the licenses section. It lists available and assigned licenses for products like Microsoft 365 E7, Microsoft Defender Vulnerability Management Add-on, and Microsoft Power Automate Free. The page highlights organizational and self-service account types.

Priority 1: coverage, starting with identity

Fund coverage in this order:

1. Defender for Identity sensors on domain controllers (plus AD FS and AD CS servers where present), and Microsoft Entra ID P2 signals.

2. Devices onboarded to Defender for Endpoint.

3. Mailboxes in Defender for Office 365.

4. The Microsoft 365 connector in Defender for Cloud Apps.

Identity leads because of what automation can reach. Per Learn, attack disruption disables an on-premises Active Directory account through a domain controller that runs the Defender for Identity sensor. Cloud-only accounts are disabled in Microsoft Entra ID without that sensor. The sensor, its auditing, and its action account permissions decide whether automation can contain an on-premises identity.

Learn also says each product has to be deployed to run its own automated response actions, and the wider the deployment, the greater the coverage. A device or identity with no sensor sends no signal. An intruder who uses it gets a longer dwell time, and a longer dwell time means more systems to remediate.

Microsoft now scores identity coverage for you. The Identity Security dashboard and the Coverage and maturity page became generally available in September 2026. The identity risk score (0 to 100) and the non-human identities tab are listed as Preview.

Part 4 of Identity Threat Protection in M365 (The Security Bridge Series™️) shows how to prove Defender XDR can see identity attacks.

Priority 2: automated response

Automatic attack disruption acts on the incident, using signals from across the XDR. Learn states that containment actions run at a confidence level of 99% or higher, based on real production data. That figure describes precision. The page publishes no average time to contain. Learn also says all automatic actions can be undone by your security team.

Predictive shielding extends disruption (Preview). Disruption contains assets that are already compromised. Predictive shielding anticipates how an attack will progress and restricts vulnerable assets or paths, for example by containing at-risk user accounts or hardening GPO settings. It needs a Defender for Endpoint license. Contain user is listed as GA as of March 2026, and device isolation by attack disruption is listed as Preview as of May 2026.

Disruption works only where the prerequisites exist. These come from Learn's attack disruption configuration page:

Item	Requirement
License	Defender for Endpoint Plan 2
Devices	Onboarded; Standard discovery for Contain device; Sense agent v10.8470 or later for Contain user
Remediation level	Device group set to Full (Learn's recommendation)
Identity	Defender for Identity sensor on the domain controller, domain controller auditing, action account permissions
Email	Exchange Online mailboxes with audit events MailItemsAccessed, UpdateInboxRules, MoveToDeletedItems, SoftDelete, HardDelete
SaaS	Microsoft 365 connector in Defender for Cloud Apps, all boxes selected

Learn recommends the Full remediation level. It also notes that as of September 1, 2026, automated investigation and response no longer runs as a separate investigation experience, and it still documents the remediation level setting.

Learn lets you exclude users, devices, and IP addresses from disruption. Each exclusion is a risk acceptance. Keep the list short and have the CISO sign it. Also check for automation that re-enables accounts, such as a script that reactivates all active employees, because it can undo a disruption action during an attack.

Priority 3: AI in the SOC, and what it costs

Security Copilot is included with Microsoft 365 E5 and E7. Learn sets the allocation at 400 SCUs per month for every 1,000 paid licenses, capped at 10,000 SCUs per month. A tenant with 400 licenses gets 160 SCUs a month, and one with 4,000 licenses gets 1,600. Allocations reset monthly and don't roll over. Usage beyond the allocation will be throttled at a future date, with a pay-as-you-go option at $6 per SCU on 30 days' notice. Sentinel data lake costs, non-agentic Data Security Investigations in Purview, Azure Logic Apps, and partner agents are billed separately.

Rollout began on November 18, 2025 and continues, so confirm in your own tenant whether capacity has been provisioned. Agents are not enabled automatically. Your team sets them up.

Every statement about the agents below comes from Microsoft's documentation as of October 2026. Check the status before you commit budget.

Capability	What it does	Status	Requirement
Security Alert Triage Agent (same agent as the Phishing Triage Agent)	Classifies alerts, resolves false positives, leaves true positives open for an analyst	Email and collaboration alerts: GA. Identity and cloud alerts: Preview	Security Copilot capacity or E5/E7 inclusion; unified RBAC; Defender for Office 365 Plan 2 for email alerts; the Defender for Identity and Defender for Cloud Apps data scopes for identity alerts; the Defender for Cloud data scope for cloud alerts
Security Analyst Agent	Runs multi-step analyses over Defender and Sentinel data	Status not published (announced as a preview in Microsoft's March 2026 blog)	Security Copilot
Threat Intelligence Briefing Agent; Dynamic Threat Detection Agent	Regular threat intelligence briefings; always-on detection across Defender and Sentinel	Status not published	Security Copilot (briefing agent); not published (detection agent)
Conditional Access Optimization Agent (Entra)	Recommends new Conditional Access policies and updates; changes need administrator approval, and new policies start in report-only mode	GA per Microsoft's March 2026 blog; several features Preview	Entra ID P1 (P2 for risk-based suggestions); available SCUs (under 1 SCU per run on average)
Defender Chat	Answers prompts inside Defender	Preview (May 2026)	Not published

The triage agent works on the queue, so it comes first. When a relevant alert is created, it runs, adds an Agent tag to the incident, and records its reasoning in natural language. A false positive gets resolved. A true positive stays open for an analyst. It skips alerts that your tuning rules already resolve, runs under a new Microsoft Entra Agent ID (Learn's recommendation) or an existing user account, and doesn't replace your investigation and response tools, per Learn. A user account gives the agent that account's permissions, can't use PIM or TAP, and stops the agent if its authentication expires, so choose a dedicated least-privilege account for that option. In Preview it also triages password spray, possible BEC-related inbox rule, and account compromised following a password-spray attack.

Learn reports gains in triage accuracy and efficiency from controlled evaluations and publishes no figures. Measure the result in your own queue.

Where Microsoft 365 E7 fits

Microsoft 365 E7 includes Microsoft 365 E5, Microsoft 365 Copilot, Microsoft Entra Suite, and Agent 365. Microsoft lists it at $99 per user per month, and it became generally available on May 1, 2026. Learn's license comparison describes E7 as a superset of E5 that adds capabilities and removes none.

Defender XDR comes with E5, so E7 includes the same workloads. The additions are in identity, network access, and agent security:

Layer	Microsoft 365 E5	Microsoft 365 E7
Defender XDR	Full	Full (E5 included)
Microsoft Entra	Entra ID P2	Full Entra Suite
Security Copilot	Included	Included
Agent security	Not included	Agent 365
Microsoft 365 Copilot	Add-on	Included

The Entra Suite adds Entra Internet Access, Entra Private Access, full ID Governance, Verified ID, and agent-aware Conditional Access. Agent 365 ($15 per user per month standalone) adds an agent inventory, Conditional Access and identity protection for agents, lifecycle governance, and Defender capabilities for agents. Those Defender capabilities have mixed statuses as of October 2026: real-time protection for Agent 365 tooling servers is GA (July 2026), and threat detection for Agent 365 agents, AI agent posture risk, and local AI agent discovery and runtime protection are Preview.

Agents are identities. Learn describes extending Conditional Access and identity protection from users to agents, with a view of every agent in the organization, including shadow agents. The same order applies to agents as to people: coverage first, then automated response.

Microsoft's list prices on October 20, 2026 (per user per month, annual commitment, with Teams):

Item	List price
Microsoft 365 E3	$39
Microsoft 365 E5	$60
Microsoft 365 E7	$99
Entra Suite	$12
Microsoft 365 Copilot add-on	$30
Agent 365 (standalone)	$15
E5 + Entra Suite + Copilot + Agent 365	$117
E5 + Entra Suite + Agent 365 (no Copilot)	$87

E7 is $18 per user per month less than the $117 combination, which is $216,000 a year at 1,000 users. Without Copilot, the parts cost $12 less than E7. E7 costs less than the parts only where the same users would also use Copilot. Microsoft notes special Entra Suite pricing for E5 customers without publishing the amount, so your contract price decides the real comparison.

Comparison of Microsoft 365 E5 and E7 plans: E7 includes enhancements such as Full Entra Suite, Agent 365, and Microsoft 365 Copilot at $99 per user per month, while E5 is priced at $60. Both plans offer similar Defender XDR and Security Copilot features but differ in additional security and collaboration tools.

User interface of the Microsoft 365 admin center displaying license management for a demo user, showing one assigned license and a detailed list of enabled services and features.

Overview of the Microsoft Entra admin center showing agent identities in the tenant, with details on recently created and active agents, and a summary of agent blueprints.

Quick wins for this month

8 changes, each with an owner and the evidence that it worked.

1. Inventory entitlements. Microsoft 365 admin center > Billing > Licenses. Owner: license administrator. Evidence: a list of workloads you hold and haven't deployed, and whether Security Copilot capacity exists.

2. Deploy what the license already includes. Start with the Microsoft 365 connector in Defender for Cloud Apps, with every box selected. Owner: security architect. Evidence: connector status shows connected.

3. Turn on preset email policies. Learn: Built-in protection is on by default, and Standard and Strict are assigned to no one until you turn them on. Standard protection suits most users, and Strict is for selected high-value or priority users. Safe Links and Safe Attachments apply only where Defender for Office 365 is licensed (E5 or the add-on). Owner: messaging administrator. Evidence: the assignment list.

4. Verify tamper protection. Learn says built-in protection turns it on by default, and Microsoft is renaming the feature "controlled configuration." Confirm the tenant-wide setting in the Defender portal and Intune, and collect IsTamperProtected from Get-MpComputerStatus through your management tool, for example an Intune remediation script. Owner: endpoint engineer. Evidence: the device count that returns True.

5. Set the remediation level. System > Settings > Endpoints > Device groups. Learn recommends Full. Owner: endpoint engineer. Evidence: no device group on "No automated response" without a written reason.

6. Start attack surface reduction rules in Audit mode on a pilot ring. Learn: audit mode doesn't affect users and logs events to review. Owner: endpoint engineer. Evidence: the audit report, reviewed before any move to Block.

7. Assign least-privilege roles. Learn recommends roles with the fewest permissions and limits Global Administrator to emergency scenarios. Owner: identity lead. Evidence: a role assignment export.

8. Pilot the Security Alert Triage Agent on email and collaboration alerts (GA). Create a new Entra Agent ID, disable tuning rules that resolve those alerts, and enable unified RBAC. Owner: SOC lead. Evidence: the agent's verdicts on a set of reported phishing alerts, checked by an analyst. This needs Security Copilot capacity.

Operations and measurement

I worked with a client who received alerts in Defender XDR. SOC staffing was insufficient to work the queue, so many alerts went without action and stayed in the queue.

A queue that nobody works produces no response, whatever the quality of the detection. The triage agent addresses part of that case: on supported alert types it resolves false positives and leaves true positives for an analyst. Staffing for the true positives stays a decision for the CISO, and so does the after-hours owner: in-house, a partner, or a mix.

The platform is also changing: after March 31, 2027, Microsoft Sentinel is supported only in the Defender portal, per Learn, after Microsoft extended the date from July 1, 2026. As of October 2026, the Integrated Security Operations Center (ISOC) in Microsoft Defender is in public preview (opened September 23, 2026), bringing XDR, SIEM capabilities, threat intelligence, automation, and AI into the Defender portal. It is open to organizations with an eligible Microsoft Defender Suite, Microsoft 365 E5, or Microsoft 365 E7 license and no active Sentinel workspace, per Microsoft's announcement FAQ and CSO Online; retention is 30 days, planned to rise to 90 days on November 15, 2026. Logs from Microsoft security products have no ingestion charge, and third-party data is metered at $2.40 per GB.

Ask the SOC for 6 numbers:

• Mean time to acknowledge

• Mean time to resolve

• The share of incidents with an automated action or an agent verdict

• The count of excluded assets

• Identity and device coverage

• SCU use against allocation

Business case

2 outside studies give context. Neither is a forecast for your tenant.

Forrester's Total Economic Impact study, commissioned by Microsoft and dated June 2025 (Microsoft announced it in September 2025), models a composite organization built from interviewed customers: 242% ROI over 3 years, $12.6 million net present value, and payback in under 6 months, including up to $12 million from vendor consolidation. The study covers Microsoft Defender including Microsoft Sentinel SIEM capabilities, not Defender XDR alone. Treat it as a modeled result for a composite organization, not an expected one for yours.

IBM's Cost of a Data Breach 2025 puts the global average breach at $4.44 million and the time to identify and contain at 241 days. Organizations that used security AI and automation extensively saved an average of $1.9 million and shortened the breach lifecycle by 80 days. That finding covers automation in general and doesn't name Defender.

Build your own model: incidents per year, times analyst hours per incident, times loaded analyst cost, plus the overlapping tool spend your held entitlements already cover, plus the E7 comparison above. 4 mechanisms connect Defender XDR to those inputs:

• Shorter dwell time leaves fewer systems to remediate.

• Containment that doesn't wait for approval removes hours from an intrusion.

• Agent triage takes false positives out of the analyst queue.

• Licenses you already hold replace duplicate tools.

Defender XDR returns value when the licenses you hold are deployed, when containment runs without waiting for approval, and when someone works the queue. The AI and E7 layers add a list-price comparison you can run this week with your own license counts.

Decisions for this month

Inventory what you own, then deploy the workloads you already pay for, identity first. Decide which assets automation may contain and sign the exclusion list, and name who works the queue after hours. Last, decide whether the Entra Suite and Agent 365 belong in your next renewal.

Part 4 of Identity Threat Protection in M365 (The Security Bridge Series™️) covers how to prove Defender XDR can see identity attacks.

Who Has Compared the Defender Workloads You License With the Ones You Deployed?

Cloud Harbor Consulting partners with security architects and CISOs to turn a Defender XDR funding decision into three priorities that each have an owner in Microsoft Defender and Microsoft Entra, with identity coverage that starts at the domain controllers, automated response with a CISO-signed exclusion list, and an alert queue with a named owner, at a license cost you can calculate before renewal. Schedule a conversation to walk your license inventory and pinpoint where undeployed workloads, missing sensors, and unworked alerts leave your Defender XDR signal unused.

Contact Us