Microsoft Defender for Endpoint

Microsoft Defender for Endpoint is endpoint protection and EDR software for Windows, macOS, Linux, iOS and Android, sold alone or inside Microsoft 365 suites.

Microsoft Defender for Endpoint watches the computers, servers and phones an organization runs, blocks common attack techniques and gives analysts the tools to investigate and contain a breach. Microsoft develops it within its Microsoft Defender security family. The agent covers Windows, macOS and Linux computers, Windows and Linux servers, and iOS and Android phones. Analysts work in the Microsoft Defender portal, where related alerts are correlated into incidents. Prevention starts with Microsoft Defender Antivirus, which is built to work both online and offline. Attack surface reduction rules stop obfuscated scripts and persistence through WMI event subscriptions. Exploit protection, device control for removable storage, web content filtering and application control on Windows narrow what an attacker can use. Every alert opens with a process tree, and automated investigation and remediation triages alerts on its own. Advanced hunting queries recorded device events, and a query can become a custom detection rule; on a compromised device an analyst can isolate it, open a live response session or collect an investigation package. Security operations teams use it to hunt and respond, while IT administrators use it to set protection policy across a mixed fleet. It suits organizations on Microsoft 365 E3 or E5, whose suites already include it. Smaller companies take Defender for Business, the version built for small and midsize businesses. Managed security providers look after several customer tenants through multitenant management in the Defender portal. It is sold on its own, as Defender for Business, or inside Microsoft 365 and Microsoft Defender Suite. A typical response begins with an incident in the Defender portal and ends with a device isolated, or a malicious file blocked everywhere through a custom indicator. Firewall rules and other security policies are set from the Defender portal or from Microsoft Intune. Device events leave through the streaming API for Microsoft Sentinel or another SIEM, so detections land where the security team already investigates. Azure virtual machines and Azure Arc-enabled servers can be onboarded automatically beside laptops and phones. The result is one agent family that prevents, detects and responds across a whole Microsoft-managed estate.