Defender for Endpoint's endpoint detection and response, which uses behaviour to detect and react to post-breach activity and continues even when Defender Antivirus is passive.
Also called endpoint detection and response.
Read more: Microsoft Learn
In the Ultra Transcenders books
SC-500SC-900SC-200AZ-802MD-102
Each book explains EDR in context, with comparison tables and the common traps.
Related terms
- Defender Antivirus passive mode
Mode in which another vendor's antivirus is primary, so Microsoft Defender Antivirus stops remediating while EDR carries on. Windows Server needs ForceDefenderPassiveMode set to enter it.
- Defender for Endpoint Plan 1
Bundled with Microsoft 365 E3, the entry-level Defender for Endpoint tier offers protection features (next-generation antivirus and attack surface reduction), central management and manual response, while EDR, advanced hunting and automated investigation are all missing from it.
- Defender for Endpoint Plan 2
The top Defender for Endpoint licence, part of Microsoft 365 E5. On top of everything in Plan 1 it brings endpoint detection and response, automatic investigation and remediation, vulnerability management, threat analytics and in-depth file analysis.
- Defender for Servers Plan 1
The lower of the two Defender for Servers tiers: it includes Defender for Endpoint integration, giving EDR and anti-malware, plus vulnerability assessment through an agent. JIT access, FIM and agentless scanning come only with Plan 2.
- EDR in block mode
Plan 2 capability of Defender for Endpoint allowing a passive-mode Defender Antivirus to block and clean up threats found by EDR after a breach. It adds protection but doesn't resolve clashes between antivirus products.
- Endpoint security policies
Settings for things like the firewall, EDR, antivirus and ASR rules, defined in either Intune or the Defender portal. Defender for Endpoint security settings management is what delivers them to machines.
- Microsoft Defender for Business
Aimed at firms with 300 users or fewer, this device security product combines next-generation antivirus with endpoint detection and response, and is easier to set up than the enterprise Defender for Endpoint Plan 2.
- Microsoft Defender for Endpoint
Microsoft's platform for antivirus and endpoint detection and response, which Defender for Servers integrates with.