Skip to main content Link Menu Expand (external link) Document Search Copy Copied
TechWorkshop L300 Understanding XDR

Task 03: Confirm all licensed Defender components are active and connected

  1. In the leftmost pane, select System, then Settings.

  2. Spot-check each area:

    • Identities: verify sensor health (no “No sensor data” or “Not healthy” patterns).

    • Endpoints: confirm onboarding trend [Use lefthand Navigation panel Assets > Devices and review the Onboarding Status column]. Confirm AV health (engine/intelligence versions are current) – [Use lefthand Navigation panel Reports > Device Health > Microsoft Defender Antivirus Health].

    • Email & collaboration: confirm protection policies are applied and detections appear [Use lefthand Navigation panel Email & collaboration > Policies & rules > Threat policies > Preset security policies > review which policy sets are applied], [Use lefthand Navigation panel Email & collaboration > Overview > review Defender for Office 365 doughnuts (Phish / Malware Efficacy) / (threat Detections)].

    • Cloud apps: confirm discovered apps and governance events are visible [Use lefthand Navigation panel Settings > Cloud Apps > Connected Apps > App Connectors.], [Use lefthand Navigation panel, Cloud Apps > App governance > review dashboard items].