Defender for Endpoint onboarding, antivirus policy, attack surface reduction and email threat protection.
A time-boxed first hour for a Defender XDR incident: claim it, read the attack story, scope users, devices and mailboxes with hunting, contain safely and document the hand-off.
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
Find the message, read why it was quarantined, release it, and report it through Submissions so a scoped, expiring allow entry replaces risky mail flow rule bypasses.
Licences and roles, techniques, payloads, targeting, training and launch settings for a Microsoft phishing simulation, how to read the results, and where advanced delivery fits.
Enable network protection from Intune, turn on web content filtering, build category policies scoped to device groups, add allow indicators, and read blocks in reports, Event Viewer and advanced hunting.
What Built-in protection, Standard and Strict presets enforce, how they outrank custom threat policies, what you still have to configure for impersonation protection, and how to verify which policy handled a message.
Onboard devices, fix the ones that don't report, manage settings everywhere, then roll out ASR rules and hunt across the fleet.
Start the series 5 partsClose the gaps attackers use: vulnerability remediation through Intune, USB device control, tamper protection, web content filtering and attack surface reduction.
Start the series 7 partsHandle an incident's first hour, understand automatic attack disruption, collect evidence with live response, keep identity sensors healthy, reduce exposure and train users.
Start the seriesSymptom, root cause, fix — and how to verify it.
Step-by-step setup guides with the exact settings.
How a feature really works, and how to choose.
Study plans for MD-102, SC-300, SC-200 and MS-102.
Tell me which error or task you'd like covered next — new guides come from readers' questions.
