Study guide
Technical reference and lesson notes
Purpose of This Lesson
This lesson introduces two major Microsoft security and compliance portals that appear throughout the SC-200 exam:
- Microsoft Defender XDR, formerly commonly referred to as Microsoft 365 Defender
- Microsoft Purview
For a Microsoft Security Operations Analyst, these portals are important because security operations rarely exist in isolation. Threat detection, incident response, identity protection, endpoint security, email security, cloud app discovery, compliance policies, data protection, and governance often overlap.
Defender XDR is primarily used for security monitoring, investigation, detection, response, and threat protection. Microsoft Purview is primarily used for compliance, data protection, information governance, insider risk, eDiscovery, DLP, and regulatory controls.
For SC-200, the key point is not to memorize every blade in each portal. The exam expects you to understand which Microsoft tool fits a scenario and how security operations workflows connect across Microsoft 365 services.
Key Concepts
Microsoft Defender XDR Overview
Microsoft Defender XDR is Microsoft’s unified security operations experience for Microsoft 365 security workloads.
It brings together signals from multiple Defender products, including:
- Microsoft Defender for Endpoint
- Microsoft Defender for Office 365
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
- Microsoft Entra ID Protection signals
- Microsoft Sentinel integration in unified security operations environments
The portal is accessed through:
https://security.microsoft.com
In older course material or older tenant interfaces, you may see this referred to as:
- Microsoft 365 Defender
- Microsoft Defender portal
- Microsoft 365 security center
- Security admin center
For exam purposes, treat Microsoft Defender XDR as the modern name for the unified Defender security operations portal.
What Defender XDR Is Used For
Defender XDR is focused on security operations. A SOC analyst uses it to:
- Review incidents and alerts
- Investigate affected users, devices, files, IP addresses, mailboxes, and cloud apps
- Correlate activity across Microsoft security products
- Perform advanced hunting
- Review threat analytics
- Take response actions
- Investigate endpoint, email, identity, and cloud app threats
- Coordinate remediation across Microsoft 365 security tools
Examples of Defender XDR workflows include:
- Investigating a phishing email detected by Defender for Office 365
- Reviewing endpoint malware alerts from Defender for Endpoint
- Investigating suspicious lateral movement detected by Defender for Identity
- Reviewing risky cloud app activity surfaced through Defender for Cloud Apps
- Hunting for suspicious process execution across endpoints
- Containing a compromised device
- Disabling or investigating a compromised user account
Microsoft Purview Overview
Microsoft Purview is Microsoft’s compliance, data security, governance, and risk management portal.
It is accessed through:
https://purview.microsoft.com
In some older material, you may also see references to:
https://compliance.microsoft.com
Purview is not primarily a SOC alert investigation portal. It is more focused on protecting and governing data, meeting compliance requirements, and managing information risk.
Purview includes areas such as:
- Data Loss Prevention
- Information Protection
- Sensitivity labels
- Retention policies
- eDiscovery
- Audit
- Insider Risk Management
- Communication Compliance
- Compliance Manager
- Records Management
- Data lifecycle management
Why Defender XDR and Purview Are Related
Defender XDR and Purview serve different primary purposes, but they overlap because security and compliance are connected.
For example:
- A phishing investigation in Defender XDR may involve sensitive data exposure concerns.
- A compromised user account may require audit log review.
- A malware incident may lead to investigation of file access or data exfiltration.
- A DLP policy in Purview may detect attempted sharing of sensitive data.
- Insider Risk Management in Purview may surface risky user behavior that also matters to security operations.
- Defender for Cloud Apps may identify risky SaaS activity, while Purview may classify or protect the data involved.
A security analyst does not need to be a full compliance administrator, but they should understand where Purview fits when the investigation involves data protection, auditing, retention, eDiscovery, or compliance policy enforcement.
Portal Navigation and Admin Center Awareness
A common starting point is the Microsoft 365 admin experience, where security and compliance portals can be reached from the admin center navigation.
The two important destinations are:
| Portal Area | Direct URL | Primary Purpose |
|---|---|---|
| Microsoft Defender XDR | security.microsoft.com | Security operations, detection, investigation, response, threat protection |
| Microsoft Purview | purview.microsoft.com | Compliance, data governance, information protection, DLP, audit, eDiscovery, insider risk |
For the SC-200 exam, the important skill is knowing which portal to use based on the task.
Use Defender XDR when the question is about security alerts, incidents, XDR correlation, endpoint response, email threats, identity-based attacks, or cloud app security investigations.
Use Purview when the question is about compliance policies, DLP, retention, information protection, eDiscovery, audit, insider risk, or data governance.
Licensing and Portal Population Delay
When Microsoft 365 security licensing is newly activated, not every feature or dashboard appears immediately.
In a real tenant, it may take time before:
- Menu items appear
- Security features become available
- Dashboards populate
- Alerts and incidents begin showing
- Defender products fully activate
- Policy areas become available
This matters operationally because a newly licensed lab or tenant may not look exactly like training screenshots right away.
For SC-200, this is less likely to be a direct exam question, but it is useful real-world context. If a feature is missing, possible causes include:
- Insufficient licensing
- Missing permissions
- Product not fully provisioned yet
- Data connector not enabled
- No data ingested yet
- Feature not available in that tenant or region
- Portal experience changed since the training material was recorded
Microsoft Defender XDR Components to Recognize
Microsoft Defender for Endpoint
Defender for Endpoint focuses on endpoint security.
It is used for:
- Endpoint detection and response
- Device inventory
- Device timeline investigation
- Malware alerts
- Suspicious process execution
- Vulnerability management
- Device isolation
- Live response
- Endpoint hunting tables
Example scenario:
A device runs suspicious PowerShell after a user opens a malicious attachment. Defender for Endpoint is the likely source of endpoint telemetry and response actions.
Microsoft Defender for Office 365
Defender for Office 365 focuses on email and collaboration threats.
It is used for:
- Phishing investigation
- Safe Links
- Safe Attachments
- Email entity investigation
- Threat Explorer
- Message trace-style investigation
- Automated investigation and response for email threats
- Remediation of malicious messages
Example scenario:
Users receive a malicious email with a credential harvesting link. Defender for Office 365 is the primary workload to investigate and remediate the email threat.
Microsoft Defender for Identity
Defender for Identity focuses on identity threats in hybrid Active Directory environments.
It is used for:
- Suspicious authentication patterns
- Lateral movement detection
- Reconnaissance against domain controllers
- Pass-the-hash or pass-the-ticket activity
- Kerberoasting detection
- Domain controller-based identity signals
Example scenario:
An attacker uses a compromised workstation to perform reconnaissance against Active Directory. Defender for Identity may generate alerts related to suspicious directory activity.
Microsoft Defender for Cloud Apps
Defender for Cloud Apps focuses on SaaS and cloud application security.
It is used for:
- Cloud app discovery
- Shadow IT visibility
- SaaS app risk assessment
- Session controls
- App governance
- OAuth app investigation
- Suspicious cloud app activity
Example scenario:
A user grants a suspicious OAuth app access to mailbox data. Defender for Cloud Apps can help investigate risky app behavior and cloud app access.
Microsoft Security Operations Context
In a SOC workflow, Defender XDR and Purview support different phases of investigation and response.
Triage
A SOC analyst begins by reviewing incidents and alerts in Defender XDR.
The analyst looks at:
- Severity
- Alert title
- Affected entities
- Detection source
- Timeline
- Evidence
- Recommended actions
- Related alerts
- MITRE ATT&CK techniques
- Whether the incident is new, active, resolved, or already assigned
The analyst’s first decision is usually whether the alert is likely benign, suspicious, confirmed malicious, or needs escalation.
Investigation
During investigation, the analyst pivots across related entities.
Common entities include:
- Users
- Devices
- IP addresses
- Files
- URLs
- Mailboxes
- Cloud applications
- Azure resources
- Domains
- Processes
Defender XDR is useful because it correlates signals across multiple Defender products. Instead of looking at endpoint, email, identity, and cloud app alerts separately, the analyst can investigate them as part of a larger incident.
Scope and Impact
The analyst must determine how widespread the issue is.
Questions include:
- How many users received the malicious email?
- Did anyone click the link?
- Was the attachment opened?
- Which endpoints executed suspicious commands?
- Was the user account compromised?
- Did the attacker access sensitive data?
- Were cloud apps or OAuth permissions abused?
- Did the activity involve privileged accounts?
- Are there signs of lateral movement?
This is where Defender XDR and Purview may overlap. Defender XDR helps identify the security event. Purview may help determine whether sensitive data was accessed, shared, retained, or exposed.
Containment and Remediation
Defender XDR can support response actions such as:
- Isolating a device
- Running antivirus scans
- Collecting investigation packages
- Blocking indicators
- Disabling compromised accounts
- Revoking sessions
- Removing malicious emails
- Submitting files or URLs for analysis
- Triggering automated investigation and response
Purview can support compliance-focused actions such as:
- Reviewing audit logs
- Investigating sensitive data activity
- Supporting eDiscovery
- Reviewing DLP events
- Applying or validating information protection policies
- Supporting legal or regulatory investigation requirements
Escalation and Documentation
A SOC analyst should document:
- What triggered the alert
- Which Microsoft product generated the detection
- Which entities were involved
- What evidence supports the conclusion
- Whether the incident was benign, suspicious, or confirmed malicious
- What containment actions were taken
- What teams need to be involved
- Whether any compliance or data exposure concerns exist
- Recommended improvements to detection or prevention
Escalation may involve:
- Endpoint team
- Identity team
- Messaging team
- Cloud team
- Legal or compliance team
- Data governance team
- Incident response team
- Client or business owner
Exam-Relevant Takeaways
For SC-200, remember these points:
- Microsoft Defender XDR is the security operations portal.
- Microsoft Purview is the compliance, governance, and data protection portal.
- Defender XDR is accessed through
security.microsoft.com. - Purview is accessed through
purview.microsoft.com. - Older references to Microsoft 365 Defender generally map to Microsoft Defender XDR.
- Defender XDR brings together Microsoft security signals across endpoint, identity, email, and cloud apps.
- Purview is important when the scenario involves DLP, audit, eDiscovery, retention, compliance, data governance, or information protection.
- A SOC analyst should know both portals but use them for different purposes.
- If the exam asks about incidents, alerts, hunting, investigation, or response, think Defender XDR or Microsoft Sentinel.
- If the exam asks about sensitive data, DLP, retention, eDiscovery, audit, or compliance policies, think Microsoft Purview.
- Portal features may depend on licensing, permissions, product provisioning, and data availability.
Tool / Feature Decision Guide
| Scenario | Best Microsoft Security Tool or Feature | Why |
|---|---|---|
| Investigate a security incident involving endpoint, email, and identity alerts | Microsoft Defender XDR | Provides unified incident and alert correlation across Defender products |
| Review phishing emails and remove malicious messages | Defender for Office 365 | Focused on email and collaboration threats |
| Investigate suspicious process execution on a workstation | Defender for Endpoint | Provides device timeline, endpoint alerts, and endpoint response actions |
| Investigate suspicious Active Directory reconnaissance | Defender for Identity | Focused on identity threats and domain controller-related signals |
| Discover unsanctioned SaaS application usage | Defender for Cloud Apps | Provides cloud app discovery and SaaS activity monitoring |
| Create or investigate DLP policies | Microsoft Purview | DLP is part of Microsoft Purview compliance and data protection |
| Review data retention or records management settings | Microsoft Purview | Retention and records management are compliance/governance functions |
| Perform eDiscovery for legal or compliance investigation | Microsoft Purview | eDiscovery is a Purview workload |
| Review security alerts and incidents | Microsoft Defender XDR | Defender XDR is the primary Microsoft 365 security operations portal |
| Review audit logs related to user or admin activity | Microsoft Purview / Microsoft 365 audit | Audit is commonly accessed through Purview compliance capabilities |
| Hunt across endpoint and identity telemetry | Defender XDR Advanced Hunting | Advanced hunting supports KQL-based investigation across Defender data |
| Build a broader SIEM/SOAR workflow with third-party data | Microsoft Sentinel | Sentinel is better for cross-platform SIEM, third-party data, analytics rules, and playbooks |
Microsoft Defender XDR vs Microsoft Purview
| Area | Microsoft Defender XDR | Microsoft Purview |
|---|---|---|
| Primary Focus | Security operations | Compliance, data governance, and information protection |
| Main Users | SOC analysts, security engineers, incident responders | Compliance admins, data governance teams, legal, risk teams, security admins |
| Portal | security.microsoft.com | purview.microsoft.com |
| Common Tasks | Investigate incidents, triage alerts, hunt threats, respond to attacks | Configure DLP, retention, sensitivity labels, eDiscovery, audit, insider risk |
| Exam Association | Detection, investigation, response, XDR, threat hunting | Compliance, audit, data protection, governance, DLP |
| Example Scenario | Malware alert on endpoint with related phishing email | Sensitive data shared externally and DLP policy triggered |
Microsoft Defender XDR vs Microsoft Sentinel
| Area | Microsoft Defender XDR | Microsoft Sentinel |
|---|---|---|
| Type | XDR platform | SIEM/SOAR platform |
| Data Focus | Microsoft Defender product signals | Microsoft, Azure, third-party, custom, and cloud data sources |
| Best For | Unified Microsoft security investigation and response | Centralized log analytics, cross-platform detection, automation, and hunting |
| Incident Source | Defender-generated incidents and alerts | Analytics rules, connected security products, Defender connector, custom detections |
| Automation | Automated investigation, response actions, custom detections | Automation rules and Logic App playbooks |
| Exam Tip | Choose Defender XDR for Microsoft 365 security workload investigation | Choose Sentinel for SIEM, log ingestion, analytics rules, playbooks, and third-party sources |
KQL Notes
This lesson does not introduce specific KQL queries.
However, SC-200 candidates should understand where KQL fits:
- Defender XDR Advanced Hunting uses KQL to search Defender telemetry.
- Microsoft Sentinel Logs and Hunting use KQL to search Log Analytics data.
- KQL is used for threat hunting, analytics rules, workbook queries, and investigation support.
A simple example of KQL in a Defender XDR context:
DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "DownloadString", "EncodedCommand")
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
What This Example Does
DeviceProcessEventssearches endpoint process execution events.where FileName =~ "powershell.exe"filters for PowerShell executions.has_anylooks for suspicious command-line patterns.projectselects the columns most useful for review.
This type of query could help a SOC analyst investigate suspicious PowerShell activity after an endpoint alert.
For this lesson, the main KQL takeaway is simple: KQL is not the portal itself. KQL is the query language used inside Microsoft security tools to search and analyze security data.
Common Exam Traps
Confusing Defender XDR with Microsoft Purview
If the scenario is about incidents, alerts, threat hunting, or response, do not choose Purview just because it is part of Microsoft 365.
Use Defender XDR for security operations.
Use Purview for compliance and data governance.
Confusing Microsoft Defender XDR with Microsoft Sentinel
Defender XDR is an XDR platform focused heavily on Microsoft security workloads.
Microsoft Sentinel is a SIEM/SOAR platform used for broader log ingestion, analytics rules, automation, and third-party data sources.
If the question says you need to connect non-Microsoft data sources, create analytics rules, or run playbooks, Sentinel is often the better answer.
Assuming Every Feature Appears Immediately
In labs and real tenants, newly enabled licenses may take time to fully activate. Missing features can also be caused by permissions, licensing, or lack of data.
Do not assume the portal is broken just because a blade is not immediately populated.
Choosing the Wrong Defender Product
Microsoft Defender XDR is the unified portal, but individual Defender products still map to different workloads.
Examples:
- Endpoint issue: Defender for Endpoint
- Phishing issue: Defender for Office 365
- Active Directory identity issue: Defender for Identity
- SaaS app issue: Defender for Cloud Apps
- Compliance or DLP issue: Microsoft Purview
Treating Compliance as Separate from Security
In real incidents, compliance and security often overlap.
A confirmed compromise may require:
- Audit review
- Data exposure analysis
- DLP review
- eDiscovery preservation
- Legal or compliance escalation
That does not mean Purview replaces Defender XDR. It means Purview may support parts of the post-incident process.
Real-World SOC Analyst Notes
Alert Fatigue
Defender XDR can consolidate multiple related alerts into incidents. This helps reduce noise, but analysts still need to validate whether the incident represents real malicious activity.
Good triage depends on understanding:
- The affected entity
- The detection source
- The timeline
- The user context
- Whether the activity is expected
- Whether there are related alerts
Investigation Quality
A weak investigation only closes the alert.
A strong investigation answers:
- What happened?
- When did it start?
- Which entities were affected?
- How far did the activity spread?
- Was the activity successful?
- What evidence supports the conclusion?
- What containment or remediation occurred?
- What should be improved?
Escalation Paths
Security operations often require handoff.
Examples:
- Endpoint isolation may involve desktop or infrastructure teams.
- Account disablement may involve identity administrators.
- Email purge actions may involve messaging administrators.
- DLP and eDiscovery may involve compliance teams.
- Firewall or proxy blocks may involve network teams.
- Business impact decisions may require management approval.
Evidence Preservation
Before taking destructive action, preserve evidence where practical.
Examples:
- Export alert details
- Capture timelines
- Save email headers
- Record affected users and devices
- Document file hashes, URLs, and IP addresses
- Note response actions and timestamps
This is especially important when an incident may involve legal, HR, compliance, or regulatory reporting.
Automation Safety
Microsoft security tools support automation, but automation should be controlled.
Examples of lower-risk automation:
- Assigning incidents
- Tagging incidents
- Sending notifications
- Creating tickets
- Running enrichment workflows
Examples requiring more caution:
- Disabling users
- Isolating devices
- Deleting emails
- Blocking domains tenant-wide
- Revoking sessions
- Changing security policies
The more tenant-wide or disruptive the action, the more important it is to consider change control and approval.
Permissions and Licensing
A SOC analyst may not see every portal option.
Access can depend on:
- Microsoft 365 licensing
- Defender product licensing
- Purview licensing
- RBAC roles
- Data source configuration
- Tenant settings
- Whether the feature has finished provisioning
In real environments, always confirm whether missing data is caused by no activity, no license, no connector, or no permission.
Cost Considerations
Defender XDR is tied to Microsoft security licensing.
Microsoft Sentinel is consumption-based for many data types, so ingestion planning matters. When sending data into Sentinel, organizations should consider:
- Which logs are required
- Retention requirements
- Analytics rule value
- Data volume
- Cost of ingestion
- Cost of long-term retention
- Whether the data supports real detections
For SC-200, remember that Sentinel is powerful, but data connectors and ingestion design matter.
Quick Reference Summary
- Microsoft Defender XDR is the modern unified Defender security operations portal.
- Defender XDR is used for incidents, alerts, investigations, hunting, and response.
- Microsoft Purview is used for compliance, data protection, governance, DLP, audit, retention, and eDiscovery.
- Defender XDR portal:
security.microsoft.com. - Purview portal:
purview.microsoft.com. - Defender XDR and Purview are related because security incidents can create compliance and data exposure concerns.
- Use Defender for Endpoint for endpoint threats.
- Use Defender for Office 365 for email and phishing threats.
- Use Defender for Identity for hybrid identity and Active Directory-related threats.
- Use Defender for Cloud Apps for SaaS and cloud app activity.
- Use Microsoft Sentinel for SIEM/SOAR, third-party data, analytics rules, playbooks, and broader log correlation.
- Newly enabled security features may take time to populate after licensing or provisioning.
Flashcards
Q: What is Microsoft Defender XDR primarily used for?
A: Security operations, including incident investigation, alert triage, threat hunting, and response across Microsoft Defender workloads.
Q: What portal is used for Microsoft Defender XDR?
A: security.microsoft.com.
Q: What is Microsoft Purview primarily used for?
A: Compliance, data governance, information protection, DLP, audit, retention, eDiscovery, and insider risk management.
Q: What portal is used for Microsoft Purview?
A: purview.microsoft.com.
Q: What is the modern name for what older material may call Microsoft 365 Defender?
A: Microsoft Defender XDR.
Q: Which tool should you use to investigate phishing emails in Microsoft 365?
A: Microsoft Defender for Office 365, usually through the Microsoft Defender portal.
Q: Which Defender product is best for endpoint detection and response?
A: Microsoft Defender for Endpoint.
Q: Which Defender product is best for suspicious Active Directory behavior?
A: Microsoft Defender for Identity.
Q: Which Defender product helps discover and monitor SaaS application usage?
A: Microsoft Defender for Cloud Apps.
Q: When should Microsoft Purview be considered during a security incident?
A: When the incident involves sensitive data, DLP, audit, eDiscovery, retention, compliance, or data governance concerns.
Q: What is a common reason a new lab tenant may not show all Defender features immediately?
A: Licensing, provisioning delay, missing permissions, or lack of data.
Q: What is the difference between Defender XDR and Sentinel?
A: Defender XDR is an XDR platform focused on Microsoft security workloads, while Sentinel is a SIEM/SOAR platform for broader log ingestion, analytics, automation, and third-party data sources.
Q: What Microsoft tool is most associated with DLP policies?
A: Microsoft Purview.
Q: What Microsoft tool is most associated with incidents and alerts from Defender products?
A: Microsoft Defender XDR.
Q: Why does a SOC analyst need awareness of both Defender XDR and Purview?
A: Security incidents may require both threat investigation and compliance or data exposure review.
Practice Questions
Question 1:
A SOC analyst receives an alert showing suspicious PowerShell execution on a Windows endpoint. The analyst needs to review the device timeline and determine what process launched PowerShell.
Which tool should the analyst use first?
A. Microsoft Purview eDiscovery
B. Microsoft Defender for Endpoint in the Microsoft Defender portal
C. Microsoft Purview Compliance Manager
D. Microsoft Entra admin center only
Correct Answer:
B. Microsoft Defender for Endpoint in the Microsoft Defender portal
Explanation:
Suspicious process execution on an endpoint is an endpoint detection and response scenario. Defender for Endpoint provides endpoint telemetry, device timeline investigation, and response actions.
Question 2:
An organization needs to configure policies to prevent sensitive financial documents from being shared externally through Microsoft 365 services.
Which Microsoft portal is most appropriate?
A. Microsoft Defender XDR
B. Microsoft Purview
C. Microsoft Defender for Identity
D. Microsoft Sentinel Hunting
Correct Answer:
B. Microsoft Purview
Explanation:
Preventing sensitive data from being shared externally is a Data Loss Prevention and information protection scenario. DLP and compliance policies are managed through Microsoft Purview.
Question 3:
A security administrator recently enabled Microsoft 365 security licensing in a lab tenant. Some expected security blades and dashboard data are not visible yet.
What is the most likely explanation?
A. Microsoft Defender XDR does not support lab tenants
B. Features may require provisioning time, correct licensing, permissions, and data availability
C. Microsoft Purview must be disabled first
D. Defender for Endpoint is only available in Microsoft Sentinel
Correct Answer:
B. Features may require provisioning time, correct licensing, permissions, and data availability
Explanation:
Newly enabled features may not appear immediately. Missing portal areas can also be caused by licensing, RBAC permissions, or lack of ingested data.
Question 4:
A SOC team wants to investigate incidents and alerts correlated across endpoint, identity, email, and cloud app signals in Microsoft 365.
Which platform is most appropriate?
A. Microsoft Defender XDR
B. Microsoft Purview Records Management
C. Microsoft Teams admin center
D. Microsoft Exchange admin center
Correct Answer:
A. Microsoft Defender XDR
Explanation:
Microsoft Defender XDR correlates security signals across Microsoft Defender workloads and provides a unified security operations experience for incident investigation and response.
Question 5:
A company wants to ingest Microsoft and third-party security logs, create analytics rules, and trigger automated playbooks.
Which tool is the best fit?
A. Microsoft Purview
B. Microsoft Sentinel
C. Microsoft Defender for Office 365 only
D. Microsoft Compliance Manager
Correct Answer:
B. Microsoft Sentinel
Explanation:
Microsoft Sentinel is the SIEM/SOAR platform used for log ingestion, analytics rules, hunting, automation rules, and playbooks across Microsoft and third-party data sources.