Ask Microsoft Anything: Microsoft Defender Attack Disruption
Learn more about attack disruption—Microsoft Defender’s built‑in, AI-powered capability that stops in‑progress attacks at machine speed by analyzing attacker intent, identifying compromised assets, and containing threats before they spread. Bring your questions and hear directly from product experts on real‑world scenarios and best practices. What is an AMA? An 'Ask Microsoft Anything' (AMA) session is an opportunity for you to engage directly with Microsoft employees! This AMA will consist of a short presentation followed by taking questions on-camera from the comment section down below! Ask your questions/give your feedback and we will have our awesome Microsoft Subject Matter Experts engaging and responding directly in the video feed. We know this timeslot might not work for everyone, so feel free to ask your questions at any time leading up to the event and the experts will do their best to answer during the live hour. This page will stay up evergreen so come back and use it as a resource anytime. We hope you enjoy!Stop identity attacks in real time with Microsoft Entra ID Protection
Modern identity security means stopping attacks before they escalate and extending protection beyond human users to apps and agentic identities across your identity fabric. Learn how Microsoft Entra ID Protection delivers premium, real-time identity protection with adaptive risk remediation, comprehensive detections, and expanded coverage for human and non-human identities. Powered by trillions of Microsoft Security signals and natively integrated with Microsoft Defender and Security Copilot workflows, Entra ID Protection enables faster and more accurate Conditional Access decisions that stop threats like lateral movement and privilege escalation before they spread. We'll show you how identity and security operations teams scale risk remediation with Entra ID, and how these capabilities extend across your broader identity security portfolio to strengthen protection in both cloud and hybrid environments. To learn more, read the Microsoft Entra ID Protection report. How do I participate? Registration is not required. Add this event to your calendar, then sign in to the Tech Community and select Attend to receive reminders. Post your questions in advance, or any time during the live broadcast.Secure containers from code to runtime | Microsoft Defender
Correlate cross-cloud attacks into a single incident, catch runtime threats that image scanning misses, and block vulnerable images before they reach production. Investigate container hijacking, isolate compromised pods with Security Copilot-guided remediation, and close the loop from SOC to dev by pushing CVE fixes to GitHub and syncing resolution back to Defender. Matt McSpirit, Microsoft Azure expert, shares how to detect, investigate, and remediate container threats in one connected workflow. Expose container hijacking at runtime. Binary drift detection flags the moment a container runs anything outside its original image. Try it now. Detection to containment in one flow. Security Copilot in Defender generates your incident report, classifies the attack, and surfaces pod isolation as a guided remediation step. Check it out. Close the loop from SOC to dev. Create GitHub issues for vulnerable container dependencies, trigger Copilot’s fix as a Pull Request, and bring “resolved” status back to Defender the moment it merges. See how it works. QUICK LINKS: 00:00 — Secure containers in Microsoft Defender 01:02 — Cross-cloud incident 03:07- Runtime detection 04:10 — Investigate and build context 04:49 — Security Copilot incident report & containment 06:03 — Prevention 07:34 — Recommendations and take action 09:04 — Wrap up Link References Get started at https://aka.ms/DefenderCloudSecurity Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -Containers are the foundation for how modern business critical apps are built, running across Kubernetes environments and multiple clouds. These are high value targets for attackers, who are now using AI to accelerate ways to find and exploit vulnerabilities faster than humanly possible, from code to runtime. And it’s hard to respond effectively when security signals and responsibilities are fragmented across different teams and tools. The challenge isn’t just finding security issues, it’s understanding how they connect across the lifecycle from development to production. -So, rather than treating supply chain and runtime as separate problems, Microsoft Defender for Cloud brings them together into a single, unified model to catch issues early in code by identifying vulnerabilities and misconfigurations, prioritizing risk across clusters, workloads, and configurations, and detecting and responding to threats in your running containers in near real time, all while tracing them back to the source to put the right mitigations in place. So let me walk you through a multi-stage attack across a containerized environment to show this in action from the perspective of a SOC analyst. I’m in Microsoft Defender in the incidents view, filtered to container related incidents, and I can see four related to containers. -Let’s start with this one: a multi-stage incident involving multiple users. And notice this is already correlated into a single incident, not multiple alerts. You can see it’s flagged as high impact, with a critical asset label, and the crown icon in the incident graph showing asset criticality. On the left, is the attack story with alerts listed in chronological order, color-coded by severity. If we go back to the incident graph, container resources are in black, and related identities and services are in white. This is runtime threat detection correlated across layers. -In this case, Defender has detected 19 alerts for this incident in near-real time and stitched them into a single timeline. So, let’s walk through the attack. Here we can see the initial access signal was from a Kubernetes API request from a proxy IP address. Identity compromise and escalation then occurred with credentials accessed from a service principal. And finally, Defender for Cloud’s cross-cloud correlation surfaces lateral movement spanning environments, revealing a brute-force attack originating from an exposed Azure Kubernetes cluster targeting an AWS Relational Database service resource. -Back in the graph, you’ll notice a blue icon, this indicates there are related attack paths. And if we ungroup similar nodes, we see a user indicated by the blue icon, and we can pivot directly into the attack path view. Here’s where it gets interesting. This is where we connect runtime activity back to security posture and exposure. It’s concluded that the container is internet-exposed with high-severity vulnerabilities, and it’s using a managed identity to access a protected storage account. We’ll come back to this in a moment to see if we can fix the root cause. So, we can see this wasn’t just an isolated runtime event; there was a clear path from exposure to exploitation. -So let’s move on to the second incident in our queue. This is another multi-stage attack. This time focused on initial access and discovery across multiple endpoints. In the Incident Graph, we can see a number of containers were accessed. Then in the attack story, we can see they were hijacked to be used as Cryptocoin miners. Now, containers should be immutable, only running what was in the original image. But this alert shows the initial binary drift. This signals to Defender that the container is executing something it was never built to run. And if we review the activities for this alert, we can see a suspicious parent process, and a shim file being used to execute it. And if we move to the right in evidence, we can see all the details for the process, file, pod and cluster. This is where runtime detection becomes critical, because this activity isn’t visible through image scanning or posture alone. -From here, we can investigate and build full context around the attack. For that, let’s drill into our Kubernetes cluster and start hunting to take a look at the processes run, across both control plane and data plane signals. There are tables that log these events for querying, CloudProcessEvents for runtime activity and CloudAuditEvents for control plane actions. Let’s run a query in the audit events table to search for the creation of a cluster-admin role binding. This would grant full administrative access to the cluster. Here, we can see the role binding and associated subject. It confirms our assumption that the privilege escalation did happen. Next, we can leverage Security Copilot to transition from investigation to response using guided recommendations informed by the attack insights uncovered. Here, Copilot has already generated an incident report. -At the top, we have a summary of the attack from correlated signals. If we expand it, under Credential Access, we see compromised identity activity. Under Discovery, there are network scanning tools. Under Execution, we see confirmation that the container was modified to run crypto mining processes. And below that, the Triage section then lets you classify the incident as true positive, informational, or false positive with corresponding subcategories. I’ll choose a True Positive Multi-stage attack. And Copilot also suggests two remediation actions: terminate the pod to stop activity or isolate the pod to contain the threat. So let’s follow that guidance and isolate the pod. So I’ll close Copilot and return to our Incident graph, then ungroup similar nodes again. Now selecting the Pod, under Actions, I can isolate the Pod. I’ll add a reason. And then I just need to confirm. And just like that, we’ve moved from detection to investigation and containment in a single flow. -So far, we’ve focused on detecting, responding to active threats. But security doesn’t start at runtime. And this is where Defender for Cloud helps your DevOps teams harden your environment to prevent issues from reaching production in the first place. Using policies, you can put rules in place to prevent containers with issues from being deployed. So for that, in the Azure portal in Defender for Cloud, under Environment Settings, we’ll head over to our Security Rules. -Here, we’ve already created a handful of rules to deny or audit activities. For example, if I take a look at this one to block vulnerable deployments of AI applications, this rule is configured to automatically deny deployment of any image violating the policy. It’s scoped specifically to the namespace of our AI applications. In the Configurations tab, we can see that this rule is set to trigger when a container image contains a high or critical severity vulnerability, with any count higher than zero. With our policy in place, let’s test it out by attempting to deploy a container image that contains a few high-severity vulnerabilities. This is exactly what happens with supply chain attacks. For that, from Cloud Shell, I’ll run an AKS command first to get my credentials. -Now I can execute my command. I’ll paste in this Kube Control command to run an image, including its location and namespace details. And immediately, we can see that the run was denied, stating that the image contains 415 CVEs, and we allowed zero in our policy. So it’s blocked. What’s more, Defender for Cloud continuously scans what’s in your registries and running environments in near real time, surfacing the risks that matter and turning them into clear, actionable fixes. Next over in Recommendations, we can see findings identified by Defender for Cloud with several critical risks highlighted, related to the same incident that we saw earlier in the Defender portal. And these are its recommendations. -Let’s look at this one to update busybox. Looks like this version has 13 known vulnerabilities. And digging into the Remediation Insights tab, we can see more details across the development phases. The Take Action button tells us to assign an owner and to create a GitHub issue. I can create the GitHub issue from here. And if I head over to what our dev team would see in GitHub, you can see the details for the ticket, with deployment info, matching CVEs for this version, and below there, there are the remediation guidelines to mitigate the issue. From there, we can assign the issue to GitHub Copilot, and the GitHub Copilot Coding Agent will generate a draft Pull request fixing the CVEs for review. Once the pull request is actioned and complete and the version is updated, we can see that the CVEs were resolved. And finally as a developer, we can merge the pull request to get our app back into a healthy state. I’m going to return back to Microsoft Defender and our app recommendation, clicking on the GitHub issues shows that everything was resolved, and it sent the updated status back to Defender where your SOC lives. -So, that’s a hands-on look at how Microsoft Defender helps secure your container environments end to end. It doesn’t just detect security issues, it helps you to respond faster by connecting security signals across the entire lifecycle, from development through production. To learn more or get started, visit aka.ms/DefenderCloudSecurity. Be sure to subscribe to Microsoft Mechanics for the latest tech updates. And thanks for watching.Ask Microsoft Anything: Microsoft Defender expands protection to AWS RDS
This highlights Microsoft’s existing protection for open‑source relational databases in Azure and extends the same database‑focused security signals, risk context, and investigation capabilities to AWS RDS: helping organizations strengthen database security the way modern applications are actually deployed. What is an AMA? An 'Ask Microsoft Anything' (AMA) session is an opportunity for you to engage directly with Microsoft employees! This AMA will consist of a short presentation followed by taking questions on-camera from the comment section down below! Ask your questions/give your feedback and we will have our awesome Microsoft Subject Matter Experts engaging and responding directly in the video feed. We know this timeslot might not work for everyone, so feel free to ask your questions at any time leading up to the event and the experts will do their best to answer during the live hour. This page will stay up so come back and use it as a resource anytime. We hope you enjoy!
Strengthening Cybersecurity for Education‑Focused Nonprofits and Education Institutions
Cybersecurity is one of the most urgent priorities facing education‑focused nonprofits and education institutions today. Whether you’re a nonprofit delivering tutoring, literacy, STEM, or adult learning programs — or a school, district, or learning organization — you’re managing growing threat complexity with lean IT teams, rising ransomware risk, and sensitive learner and staff data to protect. Leaders across the education ecosystem need practical strategies that strengthen security without slowing down their mission. The Microsoft Elevate Education team is bringing you two powerful Signature Series webinars this spring to help education‑focused nonprofits and education institutions strengthen their cybersecurity posture from the inside out. Pick the topic and time that fits your day — or register for both. Webinar 1 | May 19, 2026 Preventing the Next Organization‑Wide Incident: Identity, Access, and Ransomware for Education‑Focused Nonprofits & Education Institutions Choose your session: 8:00 – 9:00 AM PT: https://msevents.microsoft.com/event?id=2868688952 4:00 – 5:00 PM PT: https://msevents.microsoft.com/event?id=1182185119 Webinar 2 | June 23, 2026 Self-Healing Security for Education‑Serving Organizations: Automated Investigation & Response with Microsoft Defender XDR Choose your session: 8:00 – 9:00 AM PT: https://msevents.microsoft.com/event?id=237608052 4:00 – 5:00 PM PT: https://msevents.microsoft.com/event?id=2738526889 Across both sessions, you'll learn how to: Reduce risk from over‑permissioned admin accounts and always‑on access Limit your organization’s blast radius through modern identity segmentation and access controls Automate threat investigation and response to contain incidents faster — even with a lean team Manage and approve remediation actions through a unified Action center Strengthen ransomware readiness using tools many organizations already own How This Benefits Education‑Focused Nonprofits Education‑focused nonprofits and education institutions face many of the same cybersecurity pressures — rising ransomware activity, increasingly sophisticated identity attacks, and the responsibility to protect sensitive learner, staff, and organizational data — often with limited resources and little room for disruption. These sessions tell the full cybersecurity story for organizations that teach, support, and deliver education: securing who has access and automating how you respond when threats occur. Together, they help nonprofits and education institutions move toward containment‑ready, resilient security operations that protect staff, volunteers, and the learners they serve. We hope to see you there. Microsoft Elevate EDUA Practical Look at Device Analytics and Risk Signals with Microsoft Intune
As organizations increasingly rely on laptops, mobile devices, and cloud‑connected applications, visibility into device health, configuration, and security posture is critical. Performance degradation, outdated configurations, and elevated device risk can negatively affect productivity and increase exposure to security threats. Microsoft provides an integrated set of services—Microsoft Intune and Microsoft Defender for Endpoint—that support modern device management, evaluate device risk, and help organizations enforce consistent security controls across their environments. This guide explains how these services work together, the role of Microsoft Configuration Manager, and how built‑in analytics and compliance signals can be used to improve device reliability and security. The Role of Microsoft Configuration Manager Microsoft Configuration Manager (formerly System Center Configuration Manager, or SCCM) is an on‑premises management platform used to deploy applications, manage software updates, enforce configuration baselines, and evaluate compliance—primarily for Windows devices. When Configuration Manager is used together with Microsoft Intune through co‑management, organizations can extend their existing on‑premises management with cloud‑based capabilities. In a co‑managed environment: Configuration Manager continues to manage traditional workloads. Microsoft Intune adds cloud‑based device management and compliance evaluation. Management workloads can be moved gradually from Configuration Manager to Intune. This approach enables organizations to support both legacy infrastructure and modern cloud‑first device management strategies during transitions or hybrid deployments. Learn more: Co-management for Windows devices - Configuration Manager | Microsoft Learn How Microsoft Defender for Endpoint Contributes to Device Security Microsoft Defender for Endpoint is a unified endpoint security platform that delivers preventive protection, post‑breach detection, automated investigation, and response. It continuously evaluates device activity and assigns device risk levels based on observed threats and security signals. Core capabilities include: Threat and vulnerability management, which identifies software vulnerabilities and security misconfigurations Attack surface reduction capabilities to limit common attack vectors Endpoint detection and response (EDR) for alerting, investigation, and forensic analysis Automated investigation and remediation to reduce manual response effort Threat intelligence derived from Microsoft’s global security telemetry When Defender for Endpoint is integrated with Microsoft Intune, device risk levels can be used within compliance policies and Conditional Access to restrict access to organizational resources when risk thresholds are exceeded. Learn more: Integrate Microsoft Defender for Endpoint with Intune for Device Compliance - Microsoft Intune | Microsoft Learn What Microsoft Intune Provides Microsoft Intune is a cloud‑based unified endpoint management (UEM) service that enables organizations to manage devices, protect organizational data, and enforce security requirements across Windows, macOS, iOS, iPadOS, and Android devices. Core Intune capabilities include: Cross‑platform device enrollment and lifecycle management Configuration profiles to apply standardized device settings Compliance policies to evaluate whether devices meet security requirements App protection policies that safeguard organizational data within applications, including on personal (BYOD) devices Integration with Microsoft Entra ID Conditional Access for access decisions based on compliance and risk By integrating Intune with Defender for Endpoint and Conditional Access, organizations can adopt a risk‑based access model that takes real‑time device health and security posture into account. Learn more: What is Microsoft Intune - Microsoft Intune | Microsoft Learn Choosing How to Use Intune and Defender for Endpoint Microsoft positions these services as complementary: Microsoft Intune focuses on device and application management, configuration, and compliance. Microsoft Defender for Endpoint focuses on endpoint threat protection, detection, and response. Many organizations deploy both to combine centralized management with advanced security capabilities. Together, they allow device configuration, security monitoring, and access control to operate as a unified system rather than isolated tools. Microsoft Intune Licensing Overview Microsoft Intune Plan 1 is included with several Microsoft subscription offerings. For nonprofits and small organizations, Microsoft 365 Business Premium includes Intune Plan 1 by default. Other plans that include Intune Plan 1 (as of March 2025) include: Microsoft 365 E3 and E5 Enterprise Mobility + Security (EMS) E3 and E5 Microsoft 365 F1 and F3 Microsoft 365 Government G3 and G5 Microsoft Intune for Education Feature availability may vary by license, and organizations should always review the official service descriptions for current inclusions and limitations. Learn more: Licenses available for Microsoft Intune - Microsoft Intune | Microsoft Learn Designing an Effective Device Enrollment Strategy An effective enrollment strategy establishes consistent management and security controls from the start. Microsoft recommends that organizations: Define security and management objectives. Select appropriate enrollment methods such as Windows Autopilot, Microsoft Entra ID join, or manual enrollment. Apply standardized configuration and security policies. Use compliance policies to evaluate device posture. Plan for scalability and long‑term device lifecycle management. Provide end‑user guidance to support adoption. Enrollment is the foundation for applying policy, evaluating compliance, and maintaining ongoing visibility into managed devices. [learn.microsoft.com] Coordinating Intune and Defender During Device Onboarding Microsoft documents a layered onboarding approach that commonly includes: App protection policies Protect organizational data within supported applications, including on unenrolled BYOD devices. Device enrollment in Intune Enables configuration management, compliance assessment, and reporting. Compliance policies Define security requirements such as OS version, encryption, password policies, and update status. Conditional Access Enforces access decisions based on Intune compliance results and Defender for Endpoint device risk levels. Configuration profiles Apply standardized security and operational settings. This approach helps ensure devices meet baseline security requirements before accessing sensitive organizational resources. Using Endpoint Analytics to Improve Device Experience Endpoint Analytics, available in Microsoft Intune, provides insights into device performance, reliability, and user experience. Microsoft positions Endpoint Analytics as an operational analytics tool, not a real‑time threat detection system With Endpoint Analytics, IT teams can: View dashboards showing startup performance, application reliability, and device health Compare devices against established performance baselines to identify underperforming endpoints Use generated scores and insights to prioritize remediation Investigate issues affecting the end‑user experience, such as slow boot times or outdated configurations These insights help organizations shift from reactive troubleshooting toward proactive device optimization. Learn more: Endpoint analytics overview - Microsoft Intune | Microsoft Learn Summary By combining Microsoft Intune, Microsoft Defender for Endpoint, and Endpoint Analytics, organizations can manage devices consistently, evaluate device health and risk, and enforce access controls based on real conditions rather than assumptions. This integrated approach supports modern work by improving visibility, strengthening security posture, and enabling IT teams to make data‑driven decisions that protect users and organizational data.Zero Out Your Incident Queue - Human-led Microsoft Defender Experts for XDR
Offload high-severity incidents, gain full visibility into every investigation, and follow clear, guided remediation steps so you can contain attacks quickly and confidently, day or night. Extend your security operations with always-on managed detection and response and proactive threat hunting, so you can uncover hidden risks early, stop threats threats they spread, and strengthen your defenses to prevent future attacks. Maynald Savatdy, Microsoft Defender Expert, shows how to detect, contain, and hunt threats across your environment with support from human experts. Stay protected at all hours. Extend security coverage to nights, weekends, & holidays without staffing new shifts. Defender Experts for XDR includes managed detection and response and proactive threat hunting. Reduce response time and uncertainty. Take guided remediation steps from human experts instead of guessing what to do next. See how Microsoft Defender Experts for XDR works. Uncover hidden threats early. Microsoft Defender Experts proactively hunts across your environment and acts on contextual alerts before exploits become public. See it here. QUICK LINKS: 00:00 — Microsoft Defender Experts 00:54–24/7 Security Coverage 01:35 — Visibility & guidance actions 03:34 — Incidents and alerts 04:25 — Social engineering attack 05:36 — Defender Experts for hunting 06:34 — Wrap up Link References Get started at https://aka.ms/DefenderExperts Unfamiliar with Microsoft Mechanics? As Microsoft’s official video series for IT, you can watch and share valuable content and demos of current and upcoming tech from the people who build it at Microsoft. Subscribe to our YouTube: https://www.youtube.com/c/MicrosoftMechanicsSeries Talk with other IT Pros, join us on the Microsoft Tech Community: https://techcommunity.microsoft.com/t5/microsoft-mechanics-blog/bg-p/MicrosoftMechanicsBlog Watch or listen from anywhere, subscribe to our podcast: https://microsoftmechanics.libsyn.com/podcast Keep getting this insider knowledge, join us on social: Follow us on Twitter: https://twitter.com/MSFTMechanics Share knowledge on LinkedIn: https://www.linkedin.com/company/microsoft-mechanics/ Enjoy us on Instagram: https://www.instagram.com/msftmechanics/ Loosen up with us on TikTok: https://www.tiktok.com/@msftmechanics Video Transcript: -What if your security team had elite defenders available 24/7 ready to detect, respond, investigate, and hunt threats across your environment? Every day you may need to look at dozens or hundreds of incidents, and anyone of them could pose an existential threat to your organization. This is where our human-led Microsoft Defender Experts for XDR, our managed detection and response service and team come in, to work through those incidents for you. They work behind the scenes to bring deep expertise in triaging and investigating incidents, augmenting your SOC team. And you can track progress directly in Microsoft Defender. -In fact, I’m part of the global Microsoft Defender Experts team and we represent Microsoft’s own experienced security analysts and threat hunters. People who live and breathe cybersecurity. We’ve managed some of the worst situations and developed deep understanding of all the ways systems and endpoints can be compromised. We work around the clock, including after hours, weekends, and holidays, to augment your team. Defender Experts for XDR also includes a dedicated Defender Experts for Hunting service. This augments your team with our trained engineers that proactively hunt down risks and vulnerabilities across different entry points and services. If you are part of a larger organization with an expert SecOps team, you can also get Defender Experts for Hunting as a standalone service. Our human-led team of experts will work with bespoke tooling and queries, including AI. -In fact, we’ll uncover and work through advanced threats using up-to-the-second intel that automated systems might miss and correlate data from live raw sources that may not yet have been published. Let’s start in Microsoft Defender. You’re looking at the Incidents view, and normally, to stay protected, you’d need to triage these incidents and work them yourself. These are legitimate attacks unique to your organization and infrastructure. There could be dozens or hundreds of active incidents. The Defender Experts team will triage and work the incident queue for you as an opt-in managed service to augment your security team. In fact, right from the Home screen of the Defender portal, you’ll see the latest incidents that have been worked through by our Defender Experts team. These are stats for the number of investigated incidents and how many were resolved directly or with your help. -Let’s click in to see all incidents for the ones that need your attention. This status means that the recommended actions needs to be taken by someone on your team. This could be due to credential resets or policy configuration changes only your team may be authorized to perform. If I click into the incident for initial access involving one user, right up top you’ll see that it’s been assigned to Defender Experts. By default, any medium or high severity incident will get our attention. You can see the managed response provided by the Defender Expert who worked on the incident. There’s a detailed summary of what happened, how the incident started, the scope of entities and services impacted, any discovered indicators of compromise, in this case, email information and a malicious phishing URL, along with which entities were investigated. And below that are details for the Advanced Hunting Queries that were used. -Here you can see our Defender analyst was able to query emails containing the suspicious URL, which devices connected to that URL, the emails from the compromised sender account, then finally who clicked on the URL in the emails from that compromised account. And you can see the Awaited Actions below that you as the customer would need to take care of, like taking action to create an indicator that automatically blocks traffic to the URL, a password reset for the affected user, and requiring the user to sign in again by revoking their sessions. So you have full visibility into what our Defender Experts worked on and any guidance for actions that you need to take. Additionally, our Defender Experts can raise incidents and alerts themselves when suspicious activity is detected. This incident with the Defender Experts prefix was raised as both an incident and alert by our team. It’s a Teams Phishing Activity involving initial access, execution, and privilege escalation. -From the Managed Response summary, we can see the details of the attack, which the team was able to contain, and if I scroll down, you can see the specific actions completed. They first disabled the targeted account, then created an indicator to block the suspicious domain, and they were able to block incoming Teams messages from the malicious actor along with all of the related IP addresses. So as you saw, these are hands-on interventions. When something suspicious pops up, we don’t just send an alert. Our team digs in, validates what’s happening, and guides you through any containment and remediation steps that we can’t directly perform. -Let me expand on a social engineering attack to gain remote access, similar to this Teams incident I showed earlier, and how we addressed it. It started when we investigated an alert that was triggered when a user installed a remote viewing and management tool on their work device. At first glance, this type of software isn’t inherently malicious. It’s often used for legitimate IT support. However, our analysts noticed a pattern that didn’t align with normal behavior. The installation followed a series of junk emails sent to the user, an email bombing attack, and a Teams message claiming to be from Technical Support. Once installed, the adversary began using legitimate system paths to gain deeper access. Our team quickly disabled the user and attacker accounts and lines of communication, isolated the device and notified the customer, stopping the attack before it spread further into the network. -Leveraging Microsoft Threat Intelligence and access to global security data for broader querying, we identified the threat actor. Following the containment, our hunters then initiated proactive searches across other customer tenants and issued intelligence-driven notifications to prevent the spread and further compromise. This is just a recent example of how attackers combine social engineering with their tactics, techniques, and procedures. Beyond reactive support, Defender Experts for Hunting, as the name suggests, proactively hunts for threats in your environment and across the ecosystem. This the Defender Experts custom alert. It’s an overview of suspicious activity, complete with context, severity, and details. Clicking into the Summary tab, there’s a tile view of alerts, recommended queries, evidence and more. Last July, before any public CVE was announced, our team observed unusual activity on a SharePoint server where the W3WP executable was seen invoking PowerShell commands with Base64 encoding, behavior that typically signals an exploit attempt. -Using advanced hunting queries, we were able to confirm this was not just an isolated event. Based on our queries, we could confirm the attackers were actively probing weaknesses in other environments. We used the results to find the list of over 100 organizations that were vulnerable to this attack and proactively warned them of their exposure even before the exploit became widely known with guidance on how to address it. -So, whether you’re a small team looking to scale your security operations, or a large enterprise needing deeper threat insights, Microsoft Defender Experts gives you the confidence of knowing elite defenders are watching your back. To learn more or get started, head to aka.ms/DefenderExperts and keep watching Microsoft Mechanics for the latest tech updates. Thanks for watching.Securing Data with Microsoft Purview IRM + Defender: A Hands-On Lab
Hi everyone I recently explored how Microsoft Purview Insider Risk Management (IRM) integrates with Microsoft Defender to secure sensitive data. This lab demonstrates how these tools work together to identify, investigate, and mitigate insider risks. What I covered in this lab: Set up Insider Risk Management policies in Microsoft Purview Connected Microsoft Defender to monitor risky activities Walkthrough of alerts triggered → triaged → escalated into cases Key governance and compliance insights Key learnings from the lab: Purview IRM policies detect both accidental risks (like data spillage) and malicious ones (IP theft, fraud, insider trading) IRM principles include transparency (balancing privacy vs. protection), configurable policies, integrations across Microsoft 365 apps, and actionable alerts IRM workflow follows: Define policies → Trigger alerts → Triage by severity → Investigate cases (dashboards, Content Explorer, Activity Explorer) → Take action (training, legal escalation, or SIEM integration) Defender + Purview together provide unified coverage: Defender detects and responds to threats, while Purview governs compliance and insider risk This was part of my ongoing series of security labs. Curious to hear from others — how are you approaching Insider Risk Management in your organizations or labs?Beyond Visibility: Hybrid Identity Protection with Microsoft Entra & Defender for Identity
In a previous blog, we explored how Microsoft Entra and Defender for Identity form a powerful duo for hybrid identity protection. But visibility alone isn’t enough. To truly defend your organization, you need to operationalize that visibility—turning insights into action, and strategy into security outcomes. Let’s explore how to take your hybrid identity protection to the next level. From Detection to Response: Building a Unified Identity SOC Security teams often struggle with fragmented signals across cloud and on-prem environments. Defender for Identity and Entra solve this by feeding identity-based alerts into Microsoft 365 Defender and Microsoft Sentinel, enabling: Centralized incident response: Investigate identity threats alongside endpoint, email, and cloud signals. Automated playbooks: Trigger actions like disabling accounts or enforcing stricter access policies. Advanced hunting: Use KQL queries to uncover stealthy attacks like domain dominance or golden ticket abuse. This unified approach transforms your SOC from reactive to proactive. Strengthening Identity Posture with Entra ID Protection Once threats are detected, Entra ID Protection helps you contain and prevent them: Risk-based Conditional Access: Automatically block or challenge risky sign-ins based on Defender for Identity signals. User risk remediation: Force password resets or MFA enrollment for compromised accounts. Policy tuning: Use insights from past incidents to refine access controls and reduce false positives. This adaptive security model ensures that your defenses evolve with the threat landscape. To learn more about these and additional policy-driven security mechanisms, please visit: Risk policies - Microsoft Entra ID Protection | Microsoft Learn Least Privilege at Scale with Entra ID Governance Identity protection isn’t just about stopping attacks—it’s about minimizing the blast radius. Entra ID Governance helps enforce least privilege by: Automating access reviews: Regularly audit who has access to sensitive resources. Just-in-time access: Grant temporary permissions only when needed. Entitlement management: Control access to apps and groups with policy-based workflows. By reducing unnecessary access, you make lateral movement harder for attackers—and easier for auditors. To learn more about least privilege, please visit: Understanding least privilege with Microsoft Entra ID Governance | Microsoft Learn Real-Time Insights with Microsoft Sentinel Sentinel supercharges your hybrid identity protection with: Custom dashboards: Visualize risky users, sign-in anomalies, and privilege escalations. Threat intelligence fusion: Correlate identity signals with external threat feeds. Data connectors: Stream Entra and Defender for Identity logs for deep analysis and long-term retention. This gives you the clarity to spot patterns and the context to act decisively. To learn more about Microsoft Sentinel, please visit: What is Microsoft Sentinel SIEM? | Microsoft Learn Next Steps: Operationalize Your Identity Strategy To move from visibility to action: Deploy Defender for Identity sensors across all domain controllers. Integrate with Microsoft 365 Defender and Sentinel for unified threat detection. Enable risk-based Conditional Access in Entra to respond to identity threats in real time. Implement least privilege policies using Entra ID Governance. Use Sentinel for advanced hunting and analytics to stay ahead of attackers. Final Thoughts Hybrid identity protection isn’t a checkbox—it’s a continuous journey. By operationalizing the integration between Microsoft Entra and Defender for Identity, you empower your security teams to detect, respond, and prevent identity threats with precision and speed.
