We use Microsoft Defender XDR for malware detection and browser protection. We have around 500 devices to protect. We use it to get reports for each of these devices.
Information Technology Support Technician at a tech services company with 51-200 employees
Helps with malware detection and browser protection
Pros and Cons
- "We are connected to Microsoft and have every laptop enrolled. This acts as an endpoint. The tool helps me check security and compliance. I can also check what a device is doing."
- "We should be able to use the product on devices like Apple, Linux, etc."
What is our primary use case?
What is most valuable?
We are connected to Microsoft and have every laptop enrolled. This acts as an endpoint. The tool helps me check security and compliance. I can also check what a device is doing.
What needs improvement?
We should be able to use the product on devices like Apple, Linux, etc.
For how long have I used the solution?
I have been working with the product for three to four years.
Buyer's Guide
Microsoft Defender XDR
December 2025
Learn what your peers think about Microsoft Defender XDR. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
879,371 professionals have used our research since 2012.
What do I think about the scalability of the solution?
The tool's scalability is good.
How are customer service and support?
I research in forums or contact support whenever I encounter issues. We have four types of support plans available. I rate the cheapest plan a two or three out of ten since responses are slow. I rate ten out of ten for an expensive support plan.
How would you rate customer service and support?
Neutral
What's my experience with pricing, setup cost, and licensing?
We have a vendor who gives us a better price. The product is expensive. Selecting the entire Microsoft suite is cheaper than using random services or products.
Bitdefender costs around five dollars per month per device. However, Microsoft Defender XDR costs 2500 dollars per month.
We are evaluating Bitdefender for Windows.
Microsoft Defender XDR helps us save time for clients.
What other advice do I have?
Microsoft Defender XDR provides unified identity and access management. It is installed on every computer and checked from the Microsoft security admin center.
The tool is easy to use. You can use one account to log in to any Microsoft service.
We are aware of our compliance. We can now check the devices and get reports about it.
The product can adapt to evolving threats. We use it to manage only one tenant. We have Mac devices where Microsoft Defender XDR cannot help us.
We have the tool deployed across different locations like Germany and Denmark.
I rate the product an eight out of ten. You need to follow its guidelines.
Which deployment model are you using for this solution?
Private Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Microsoft Azure
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Cloud Sales Specialist at a tech vendor with 201-500 employees
Emerging technologies, stable, but expensive
Pros and Cons
- "Microsoft 365 Defender is a stable solution."
- "Microsoft 365 Defender does not have a unique package with emerging endpoint security technologies, such as EDR and XDR."
What needs improvement?
Microsoft 365 Defender offers emerging endpoint security technologies, such as EDR and XDR and Zero trust approach
For how long have I used the solution?
I have been using Microsoft 365 Defender for approximately two years.
What do I think about the stability of the solution?
Microsoft 365 Defender is a stable solution.
How are customer service and support?
I am satisfied with the technical support.
How was the initial setup?
The solution is included in Windows 10.
What's my experience with pricing, setup cost, and licensing?
Microsoft is not competitive with the pricing of the solution. The competitors are able to offer lower discounts. The price of the solution is higher.
What other advice do I have?
Microsoft 365 Defender is Microsofts first try at a security package as part of Windows.
They are offering different services with Zero Trust security, SIAM security, SOAR security with Azure. They converge all products in the same security center. Microsoft 365 Defender is one strong point to the overall security protection.
I rate Microsoft 365 Defender a five out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer. partner
Buyer's Guide
Microsoft Defender XDR
December 2025
Learn what your peers think about Microsoft Defender XDR. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
879,371 professionals have used our research since 2012.
Security Analyst at a tech vendor with 5,001-10,000 employees
Enhanced visibility, useful automated routines, and scales wells
Pros and Cons
- "The most valuable features of Microsoft 365 Defender are the combination of all the capabilities and centralized management."
- "The support could be more knowledgable to improve their offering."
What is our primary use case?
We rely on Microsoft 365 Defender for workstation detection across a number of categories, including virus detection, potential unknown application detection, and monitoring for suspicious website interactions, including clicks and access attempts.
I have used Microsoft 365 Defender in the cloud.
How has it helped my organization?
We have experienced significant advantages from implementing Microsoft 365 Defender, as it provides enhanced visibility into workstations and the ability to automatically remediate threats. This means that not every incident requires manual intervention, as certain tasks can be handled automatically, often in conjunction with Microsoft Sentinel.
We are able to ingest collected data from our entire ecosystem. This is an important feature.
We are able to prioritize threats accounts our whole environment.
The solution has helped automate routine tasks and help automate high-value alerts.
The threat intelligence has helped prepare us for potential threats before they hit and we took proactive steps. We are able to check our workstations are well.
We have saved some time by using the solution.
I have found that having solutions from multiple vendors is more helpful than from one.
What is most valuable?
The most valuable features of Microsoft 365 Defender are the combination of all the capabilities and centralized management.
What needs improvement?
The support could be more knowledgable to improve their offering.
For how long have I used the solution?
I have been using Microsoft 365 Defender for approximately one and a half years.
What do I think about the stability of the solution?
The solution is stable.
What do I think about the scalability of the solution?
We have a few thousand people using this solution in my organization.
The scalability of Microsoft 365 Defender is scalable.
How are customer service and support?
I have used the support and they do not know how to fix the issues. Their knowledge could improve.
I rate the support from Microsoft 365 Defender a seven out of ten.
How would you rate customer service and support?
Neutral
Which solution did I use previously and why did I switch?
We have used Microsoft Sentinel. Microsoft Sentinel enables us to investigate threats and respond holistically quickly from one place.
The comprehensive features of Sentinel Security Protection are impressive, particularly its integrated SOIR and UEBA functionalities, as well as its robust threat intelligence capabilities.
I have used McAfee previously and Microsoft 365 Defender is much better.
What other advice do I have?
I rate Microsoft 365 Defender a ten out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Desktop Architecture and Design at a tech services company with 1-10 employees
Blocks and Monitors for security purposes without needing multiple other products to do different tasks
Pros and Cons
- "We can use Defender to block and monitor for security purposes without needing multiple other products to do different tasks."
- "The logs could be better."
What is our primary use case?
We primarily use the solution for security. We removed all other antivirus products such as McAfee. We removed everything and now use Defender as Defender covers everything all third-party products used to cover.
What is most valuable?
Overall, we are satisfied with the product.
Instead of using three or four tools for security, we can use one. With one product, Defender, we have all of the features we need. We can use Defender to block and monitor for security purposes without needing multiple other products to do different tasks.
It's very user-friendly.
What needs improvement?
The dashboards could be improved. They have to improve something about the dashboard. It is good, however, they need to provide some more information under each account.
The logs could be better.
For how long have I used the solution?
I've been using the solution for two years.
What do I think about the stability of the solution?
The solution is a perfectly stable product.
What do I think about the scalability of the solution?
The scalability of the product is good.
How are customer service and support?
Technical support from Microsoft is good. We haven't had any issues with them. We are quite satisfied so far.
Which solution did I use previously and why did I switch?
We previously used McAfee, however, we wanted to have just one solution, Defender, to cover everything.
How was the initial setup?
The solution's initial setup is not complex yet not easy. We had to use some scripts and policies and a lot of things. If you set up a new environment with Defender, you have to integrate with the old policy and the same policy that was already set up. It needs time.
What about the implementation team?
I handled everything without any consultation from any outside sources.
What's my experience with pricing, setup cost, and licensing?
I don't know the cost. The costs are handled by management. I can't say if the cost is expensive or not. I don't handle that aspect.
What other advice do I have?
We're Microsoft partners.
I'd rate the solution at a ten out of ten. It's a pretty perfect product.
Which deployment model are you using for this solution?
Hybrid Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer. partner
Security Solutions Architect at a computer software company with 10,001+ employees
Integrates well, has good native capabilities, and offers flexible configurations
Pros and Cons
- "It gives a lot of flexibility in terms of configuration and customization as per the business requirements."
- "I personally have not seen much evidence of how Defender can enhance the story of zero trust for enterprises."
What is our primary use case?
We have very strong DLP policies. The product will inspect each and every outgoing email and what kind of attachments they have, including if any have business-sensitive information such as outgoing email going to some public domain such as Gmail or Yahoo. If the solution detects this, it'll raise an alarm and notify the required teams. On top of that, the incoming email will scan attachments for any potential malware tech or any phishing link.
What is most valuable?
The native capabilities are quite good as it slips in seamlessly as part of our integration.
It integrates well without AD, Active Directory.
It gives a lot of flexibility in terms of configuration and customization as per the business requirements.
What needs improvement?
These days, in the security industry, there is a buzzword called zero trust. I personally have not seen much evidence of how Defender can enhance the story of Zero Trust for enterprises. Microsoft needs to offer more features here or spread awareness in the industry and the market about how Defender addresses Zero Trust issues.
For how long have I used the solution?
I've used the solution for more than a year now.
What do I think about the stability of the solution?
The stability is good. it's up to the mark.
What do I think about the scalability of the solution?
It's usually scalable.
We're using it on a daily basis.
The solution works for any size of organization. There is no such limitation for Microsoft as the ecosystem they have built doesn't really have a limiting factor. It will work for a small sized up to a big-sized organization. Our company is half a million strong. If it satisfies our needs, then definitely it can satisfy anybody else as well.
How are customer service and support?
I personally have never reached out to technical support as our in-house expertise is good enough.
It's good for the most part, as it is their own homegrown product and they understand it well.
Which solution did I use previously and why did I switch?
We haven't worked with any other products.
How was the initial setup?
The setup is a simple process, however, users can adopt the phase-in approach and start simple and then yeah. For example, over a period of time, you can achieve what you want to achieve, but not in a single shot. You can do it in phases and work everything in slowly.
The amount of time it will take to deploy Defender depends, actually. If a customer is already sure about all the processes and reporting information they require, then to start, it should not take more than a couple of months, including planning.
There is some maintenance required. We need a team to run the show, however, when you compare it to other options, the maintenance requirements are reduced. We typically have a cloud operations team to oversee it, and it's business as usual. Our company is able to provide any needed maintenance services to our clients.
What about the implementation team?
Our company integrates this solution into our client's infrastructure.
What's my experience with pricing, setup cost, and licensing?
We have E3 and E5 licenses for our users and there is the default.
Depending on the user role, the senior people and critical positions have been allocated the E5 licenses and the intermediate users have been allocated E3 licenses.
Whether it is inexpensive or not is not a very straightforward question as, when you compare the total cost, you have to consider the total cost of ownership. It's not only a comparison between two products. You have to see the other dependencies when you deploy any other solution. That said, I would say it is more or less cost-effective.
What other advice do I have?
We are partners with Microsoft.
I'm in a customer-facing role where we propose different email security solutions to our customers. My role demands that I identify the required security solutions for the different needs of our customers.
We are on the latest version of the product.
I'd advise potential new users to define their business requirements first, however, it's likely Defender will need them and provide what they need.
I'd rate the solution at a nine out of ten.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Senior Cloud Architects at a manufacturing company with 501-1,000 employees
Stable, scalable, but machine learning and AI could improve
Pros and Cons
- "I have found the ability to delete unwanted threats beneficial."
- "The solution could improve by having better machine learning and AI. Additionally, the interface, documentation, and integration could be better."
What is our primary use case?
I use the solution for security against system threats.
What is most valuable?
I have found the ability to delete unwanted threats beneficial.
What needs improvement?
The solution could improve by having better machine learning and AI. Additionally, the interface, documentation, and integration could be better.
For how long have I used the solution?
I have used this solution for approximately one year.
What do I think about the stability of the solution?
The solution is stable.
What do I think about the scalability of the solution?
Microsoft 365 Defender is scalable.
What's my experience with pricing, setup cost, and licensing?
The price of the solution is high compared to others and we have lost some customers because of it.
What other advice do I have?
I rate Microsoft 365 Defender a seven out of ten.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Senior IT Executive and Operation at a tech services company with 51-200 employees
A unified enterprise defense suite that's very stable, but the price could be better
Pros and Cons
- "I like that it's stable. It's been stable for a long time, and Microsoft Defender has done a good job there."
- "The price could be better. It'll also help if they can continuously update and upgrade the solution. Every day there's a new virus uploaded into the network, and we have to keep updating it to identify all these things."
What is our primary use case?
The primary use case for Defender is to control the endpoint systems at the user level. On the networking level, we use it to analyze spam and see if any antivirus services are required or if there's a ransomware attack. As of now, I am just using it for monitoring.
What is most valuable?
I like that it's stable. It's been stable for a long time, and Microsoft Defender has done a good job there. I can see a lot of changes to Microsoft 365 Defender when I compare what we have now to what we had from 2007 to 2010. They have implemented a ransomware feature, and if any virus comes into the system, it triggers an alert.
What needs improvement?
The price could be better. It'll also help if they can continuously update and upgrade the solution. Every day there's a new virus uploaded into the network, and we have to keep updating it to identify all these things.
For how long have I used the solution?
I have been using Microsoft 365 Defender since 2007.
What do I think about the stability of the solution?
Microsoft Defender is very stable, and you can see that there is a 99.9% success rate when they give us good service. It's very helpful for configuring anything.
What do I think about the scalability of the solution?
It's definitely easy to scale. However, scalability depends on the plan and requirements.
How are customer service and technical support?
They have their norms and regulations that they use once a ticket is created. Whatever the technical issues are, they normally resolve them within the timeline or some days. They are good at the technical side of things.
How was the initial setup?
The initial setup is totally easy. It's not complex. It takes just a couple of minutes to deploy this solution.
What's my experience with pricing, setup cost, and licensing?
The price could be better. Normally, the costs depend on the country you're located in for the license. When we were in the initial stage, we went with the E5 license they call premium standard. It cost us around $5.20 per month for four users.
What other advice do I have?
I would recommend Microsoft Defender to new users. I would advise them to understand their exact requirements and check if it matches before taking it up.
On a scale from one to ten, I would give Microsoft 365 Defender a seven.
Which deployment model are you using for this solution?
Public Cloud
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Lead Solutions Architect at a tech vendor with 10,001+ employees
Integrates well, easy to maintain, but data recovery needs improvement
Pros and Cons
- "The solution is well integrated with applications. It is easy to maintain and administer."
- "The data recovery and backup could be improved."
What is our primary use case?
We use the solution to back up our data frequently.
What is most valuable?
The solution is well integrated with applications. It is easy to maintain and administer.
What needs improvement?
The data recovery and backup could be improved.
For how long have I used the solution?
I have been using the solution for a couple of years.
What do I think about the stability of the solution?
The solution is stable.
What do I think about the scalability of the solution?
The solution is scalable, you do not need to worry about resources. I have more than 50 users using the solution in my organization.
How are customer service and technical support?
The support provides a 24 hrs service which I am completely satisfied with.
How was the initial setup?
The installation was straightforward it did not take very long to deploy the backup software on any application.
What about the implementation team?
We have six people that do the maintenance of the solution in my organization.
What's my experience with pricing, setup cost, and licensing?
The solutions price is fair for what they offer.
What other advice do I have?
I recommend this solution to others, it is easy to use and they will enjoy it.
I rate Microsoft 365 Defender a seven out of ten.
Which deployment model are you using for this solution?
On-premises
Disclosure: My company has a business relationship with this vendor other than being a customer. Partner
Buyer's Guide
Download our free Microsoft Defender XDR Report and get advice and tips from experienced pros
sharing their opinions.
Updated: December 2025
Product Categories
Extended Detection and Response (XDR) Endpoint Detection and Response (EDR) Microsoft Security SuitePopular Comparisons
CrowdStrike Falcon
Microsoft Intune
Microsoft Defender for Endpoint
Microsoft Entra ID
Microsoft Defender for Office 365
Fortinet FortiEDR
Microsoft Defender for Cloud
Microsoft Sentinel
SentinelOne Singularity Complete
IBM Security QRadar
HP Wolf Security
Microsoft Purview Data Governance
Cortex XDR by Palo Alto Networks
Elastic Security
Buyer's Guide
Download our free Microsoft Defender XDR Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What is the best EDR or XDR product for a company with 9000 employees?
- When evaluating Extended Detection and Response (XDR), what aspect do you think is the most important to look for?
- How do you decide about the alert severity in your Security Operations Center (SOC)?
- Which is better for Endpoint Security: EDR or XDR solutions?
- What are the main differences between XDR and SIEM?
- Why is (XDR) Extended Detection and Response important for companies?
- How do you use the MITRE ATT&CK framework for improving enterprise security?
- What tools and solutions do you use for automated incident response in an enterprise in 2022?
- FortiXDR vs Cortex Pro - which is the best?
- What is Cognitive Cybersecurity and what is it used for?












