How to Map the Microsoft Defender Product Family to Your Environment

Retrospective: this article looks back at events from September 2020, written in 2026 with the benefit of hindsight.

Microsoft's security product names have changed many times. Here is a practical map of the Microsoft Defender family — what each product does and how to decide which you need.

The core XDR products

• Microsoft Defender for Endpoint: endpoint detection and response (EDR), antivirus, attack surface reduction and vulnerability management for Windows, macOS, Linux, iOS and Android.
• Microsoft Defender for Office 365: email and collaboration protection — Safe Links, Safe Attachments, anti-phishing, attack simulation.
• Microsoft Defender for Identity: detects attacks against on-premises Active Directory using sensors on domain controllers, AD FS and AD CS.
• Microsoft Defender for Cloud Apps: SaaS security — shadow IT discovery, app governance for OAuth apps, session controls.

These feed Microsoft Defender XDR, which correlates alerts into incidents in the Defender portal.

Cloud workload protection

• Microsoft Defender for Cloud: cloud security posture management (secure score, recommendations, attack paths) and workload protection plans for servers, storage, databases, containers, Key Vault, APIs and AI — across Azure, AWS and GCP.

SIEM

• Microsoft Sentinel: SIEM and SOAR, now available in the unified Defender portal.

Licensing at a glance

• Microsoft 365 E5 (or E5 Security add-on) includes Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity and Defender for Cloud Apps.
• Microsoft 365 Business Premium includes Defender for Business and Defender for Office 365 P1.
• Defender for Cloud plans and Sentinel are billed in Azure.

How to decide

Map your environment: Windows-heavy endpoints, Microsoft 365 email, on-prem AD, Azure/AWS workloads. Then check what your licenses already include before buying anything new.