Microsoft-Defender-Xdr-(Microsoft-365-Defender) on Ru Campbell MVP

[Updated August 2026] MDE Feature Comparison by OS

Tue, 04 Aug 2026 09:00:00 +0100

Three months after the last big refresh, I’ve worked through Microsoft’s Defender documentation again and updated my cross-platform comparison of Microsoft Defender for Endpoint features by operating system.

The big changes relate to AI agent security, ASR minimum version changes, and the Defender deployment tool (DDT).

You can find the updated comparison here:

MDE Feature Comparison by OS

Quick plug

If the comparison is useful and you want to go much deeper, MDE In Depth, 2nd Edition is available now. Paul, Ian, and I cover the architecture, deployment, configuration, investigation, hunting, response, and day-to-day operation of Defender for Endpoint in considerably more detail than I can fit into one comparison table.

[Updated May 2026] MDE Feature Comparison by OS

Tue, 05 May 2026 09:00:00 +0000

Paul, Ian, and I just finished publishing the second edition of MDE In Depth, so to coincide, I’ve refreshed the comparison of MDE features and capabilities by OS type. Long overdue.

At the same time, I’ve migrated my blog from Bluehost + WordPress to a Hugo static site hosted on Azure Static Web Apps. GitHub Copilot made this so straight forward.

One of the nice side effects of moving to this platform (and leveraging GitHub Copilot) is I could finally turn the comparison into something web-based that’s easier to keep updated, nicer to use than Excel/PDFs, and (soon) easier for folks to report corrections against.

[Updated Feb 2024] Ultimate Comparison of Defender for Endpoint Features by OS

Fri, 16 Feb 2024 17:13:38 +0000

Finally, it’s time for a refresh. It’s been a while! Due to personal circumstances, I haven’t been able to keep the Ultimate Comparison of MDE by OS updated. I’ve had time to dive into the changes since v5 and it’s really been amazing to see MDE grow in scope.

What is MDE and why do we need an ‘ultimate comparison’?

Microsoft Defender for Endpoint (MDE) is a massive stack of endpoint protection and endpoint detection and response (EDR) capabilities. It integrates with the broader Microsoft Defender XDR and is available for almost any OS you’ll find in an enterprise. This cross-platform nature of MDE makes it difficult to understand and track what features and capabilities are available on each OS. It’s not always intuitive, and you may be in for some surprises. Hence by I began the Ultimate Comparison of Defender for Endpoint Features by OS up to date to keep you aware of what you’re getting and what you need to go start implementing if you haven’t already.

Exchange Online Protection & Defender for Office 365 - Common Microsoft 365 Security Mistakes Series

Tue, 19 Dec 2023 08:26:45 +0000

Exchange Online Protection (EOP) and Microsoft Defender for Office 365 (MDO) are the email and collaboration security services native to Microsoft 365. EOP is included at all levels of licensing for Exchange Online, with MDO bringing additional security capabilities to license levels such as Business Premium, Microsoft 365 E3, and Microsoft 365 E5.

In this blog, I’ll review five of the most common security mistakes I see in tenants regarding EOP and MDO. Realistically, this list could go to fifty mistakes, but I’ll focus on ones I think you can quickly convert into quick wins or just may have never crossed your mind.

Microsoft Improves and Simplifies Defender for Endpoint Management Capabilities

Mon, 10 Jul 2023 20:47:03 +0000

In one of the biggest changes to Microsoft Defender for Endpoint (MDE) in its product history, you no longer need a separate management engine to configure endpoint settings.

In this blog, we’ll look at what that change is, why it was necessary, initial impressions, and what you might want to do next.

Historic management architecture needed simplifying

MDE (and it’s Windows client, Microsoft Defender Antivirus (MDAV)) always stood out from the crowd of endpoint protection platforms as being, well, a bit weird in terms of management architecture. With most platforms, you get a central admin console which pushes out endpoint settings. Think scan schedules, quarantine rules, exclusions, CPU throttling, etc. MDE/MDAV, on the other hand, instead relied on an external management tool such as Intune (MDM), Configuration Manager, or Group Policy.

[Feb 2023] Ultimate Comparison of Defender for Endpoint Features by OS

Sun, 19 Feb 2023 15:46:12 +0000

Microsoft Defender for Endpoint (MDE) is a massive stack of endpoint protection and endpoint detection and response (EDR) capabilities. It integrates with Microsoft 365 Defender (the broader XDR platform) and is available for almost any OS you’ll find in an enterprise. This cross-platform nature of MDE makes it difficult to understand and track what features and capabilities are available on each OS. It’s not always intuitive, and you may be in for some surprises. I try to keep this Ultimate Comparison of Defender for Endpoint Features by OS up to date to keep you aware of what you’re getting and what you need to go start implementing if you haven’t already.

Ultimate Comparison of Defender for Endpoint Features by OS [Updated August 2022]

Fri, 26 Aug 2022 07:32:32 +0000

This is the updated “matrix” of OS supported for the almost 80 features, services, and important components that make up Microsoft Defender for Endpoint. This follows up on my March 2022 release of the comparison.

What’s new?

Now available in Excel format, which was the biggest request :)
Added the new Microsoft Defender Vulnerability Management capabilities (add-on license required)
Added macOS tamper protection support
Added macOS network and web protection
Added iOS and Android’s mobile network protection
Added Linux cloud-delivered protection support
Added Windows troubleshooting mode
Added macOS, iOS, and Android support for network indicators of compromise
Updated host firewall reporting supported OSs
Updated attack surface reduction (ASR) rule supported Windows and Windows Server versions
Updated block at first sight (BAFS) supported OSs (thanks Polle Vanhoof + Thomas Verheyden)
Updated Windows Server support for indicators of compromise (thanks Polle Vanhoof + Thomas Verheyden)
Removed preview references for the unified agent for Windows Server 2012 R2 and 2016

Obligatory disclaimers:

Updated March 2022: Ultimate Comparison of Defender for Endpoint Features by Operating System

Tue, 29 Mar 2022 07:27:18 +0000

It’s been about 5 months since I last updated my comparison of Defender for Endpoint features by OS. This is a “matrix” of the tons of features, services, and important components that make up Microsoft Defender for Endpoint.

Three months later, it’s overdue an update. So here it is :) I’ve also decided to rename it to The Ultimate Comparison of MDE Features by OS… because renaming’s what we do, right?