# Microsoft Defender XDR **Entity class:** Extended detection and response platform **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition **Microsoft Defender XDR** is Microsoft's unified extended detection and response layer. It correlates security signals across endpoints, identities, email, collaboration services, cloud applications, and infrastructure into incidents with automated investigation and response. ## Modern Defense and Cybersecurity Role The platform turns Microsoft's installed base into a distributed defensive sensor network. Its operational importance lies in correlating activity that appears harmless within one product but becomes recognizable as an attack when identity, endpoint, email, and cloud events are joined. ## Chronological Proximity The XDR layer consolidated during the 2020s as Microsoft's formerly separate Defender products became one security-operations fabric and [[wiki/Microsoft Sentinel|Sentinel]] entered the same portal. ## Relational Proximity [[wiki/Microsoft Defender for Endpoint|Defender for Endpoint]], [[wiki/Microsoft Defender for Identity|Defender for Identity]], and [[wiki/Microsoft Defender for Cloud|Defender for Cloud]] supply domain telemetry; Sentinel supplies longer-term SIEM, hunting, and orchestration. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender)