Identity and security
EDR
Endpoint Detection and Response
Endpoint Detection and Response describes a category of security tooling that continuously monitors what actually happens on a device: process creation, file writes, registry changes, network connections, memory behaviour.
Why EDR matters in a Microsoft estate
EDR matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How EDR shows up in practice
This is rather than relying solely on signature matching against a database of known-bad files, which is the fundamental limitation traditional antivirus was built around, and which modern malware routinely evades through polymorphism, fileless techniques, and living-off-the-land abuse of legitimate system tools like PowerShell. Microsoft's EDR implementation, Defender for Endpoint, ingests this behavioural telemetry into a cloud-based analytics engine that can recognise attack patterns across the sequence of events rather than any single event in isolation, surfacing alerts with a reconstructed timeline of what a threat actor actually did on the device.
It also gives responders live response, a remote shell-like capability to investigate and remediate an active incident, run scripts, or collect forensic evidence directly on an affected endpoint without needing separate remote-access tooling. Attack surface reduction rules work alongside detection as a preventative layer, blocking specific behavioural patterns commonly abused in exploitation, such as Office applications spawning child processes or scripts running from email attachments, before they can execute at all. EDR in block mode lets Defender for Endpoint's behavioural blocking take effect even on devices where a third-party antivirus product remains the primary, real-time protection engine, catching what that other product's own detections miss.
Threat and vulnerability management is the piece that connects detection back to prevention at scale, continuously inventorying installed software and known CVEs across the managed device estate and prioritising remediation by actual exploitability and business context rather than raw CVSS score alone. The distinction worth being precise about is that EDR is reactive and investigative by nature, built around the assumption that some things will get past preventative controls and need to be detected, understood, and contained quickly, whereas endpoint protection platform capabilities like real-time antivirus scanning are preventative.
Defender for Endpoint bundles both under one sensor and one console, which is why it is licensed in tiers: Plan 1 covers attack surface reduction and manual response, while Plan 2 adds the full EDR, automated investigation, and threat and vulnerability management capability that most organisations actually mean when they say EDR. Onboarding coverage gaps are the most common practical failure mode. Devices that were never enrolled through Intune, group policy, or a manual onboarding script sit completely outside EDR visibility. Because that absence produces no alert of its own, an unmonitored device can go unnoticed for months, until it becomes the entry point in an actual incident.