Who does what
Provider
- Investigate eligible Defender XDR incidents
- Hunt within covered Microsoft products
- Contain eligible assets with Security Operator access
Your team
- License and actively deploy eligible products
- Set access permissions and asset exclusions
- Remediate outside scope and handle recovery
Coverage
- Endpoints
- Identity & Access
- SaaS Applications
Details
Service scope
Best for Teams already operating eligible Defender and Entra products with delegated response access
Response authority
Security Operator access permits documented actions. Reader access leaves execution to you. Response exclusions use devices or users, not a per-action approval list.
Plan boundary
Plan 1 is the former Defender Experts for XDR. Plan 2 adds selected third-party telemetry through Sentinel. Defender for Cloud coverage requires separate Servers scope.
Cloud eligibility
This profile covers the commercial service. Government buyers need the separate eligible Gov offer. GCC High, DoD and sovereign cloud are outside current availability.
Full service analysis
Microsoft Defender Experts MDR Plan 1 investigates Defender incidents and can contain eligible threats with Security Operator access. You maintain the licensed products, choose covered assets and exclusions and complete actions outside its access and recovery.
- Your team owns
- Licensing and actively deploying the eligible Defender and Entra products that define service coverage
- Granting and maintaining the access level that determines whether Microsoft can act directly or only guide response
- Setting excluded devices and users where Microsoft should not remediate directly
- Remediating assets, products, incidents and business impacts outside Defender Experts scope
- Confirming standalone Plan 1 versus Suite pricing, prerequisites, data residency and service terms before purchase
Current plan names
Microsoft identifies MDR Plan 1 as the renamed Defender Experts for XDR service. Plan 2 adds selected non-Microsoft sources collected in Sentinel, including separate detection content and service prerequisites.
Permissions and exclusions
Managed response can isolate devices, quarantine files, restrict apps, disable users and soft-delete email on eligible assets. A response exclusion still allows guidance. An asset outside a scoped-coverage agreement receives neither response nor guidance.
Microsoft licensing
Microsoft Entra ID P1 supports service eligibility, but identity investigation requires P2. At least one covered product must be deployed in active mode. Underlying security licenses and server coverage must be matched to the order.
Pricing & contract
- Billing
- Per-user, Custom
Plan 1 is sold separately from the underlying Defender licenses and can also be bought within Defender Experts Suite. Suite has a 1,500-license minimum. MDR Plan 2 separately requires 1,500 seats and Sentinel. Plan 1 includes a Security Delivery Expert at 1,500 or more seats, cloud workloads or both. Confirm the exact SKU, covered-server billing and support allocation in your quote.
Tradeoffs & buying questions
Strengths
-
Existing Defender incident workflow
Works in the existing Microsoft Defender incident queue.
-
Documented response permissions
Documents specific response actions, access roles and asset exclusions.
-
Investigation and proactive hunting
Combines ongoing investigation with proactive hunting for licensed Microsoft workloads.
Considerations
-
Requires eligible active Microsoft deployments
Plan 1 coverage depends on licensed, actively deployed Microsoft products.
-
Pending actions and recovery stay with the buyer
Customers complete pending actions and recovery outside delegated access.
-
Plan 2 and Servers have separate scope
Third-party telemetry and Defender for Cloud coverage need different service scope.
Ask before buying
- Which active products and covered assets are included in Plan 1?
- Which users or devices need response exclusions, and who owns pending actions?
- Which SKU, minimum, server billing and Security Delivery Expert allocation are quoted?
Integrations
Endpoint
- Microsoft Defender for Endpoint P2
Other integrations
- Microsoft Defender XDR
- Microsoft Defender for Office 365 P2
- Microsoft Defender for Identity
4 more integrations
- Microsoft Defender for Cloud Apps
- Microsoft Entra ID P2
- Microsoft Sentinel incident synchronization
- Microsoft Graph security API
Common questions
Is this the former Defender Experts for XDR?
Yes. Microsoft now calls that service Defender Experts MDR Plan 1. Plan 2 adds selected third-party telemetry through Microsoft Sentinel.
Can Microsoft act without asking us each time?
With Security Operator access, experts can execute supported actions on eligible assets. You can exclude users or devices from response, but Microsoft does not offer per-action customization of managed response. Reader access provides guidance only.
Does Plan 1 cover cloud servers?
Servers protected by Defender for Endpoint can be covered with the required server license and count as users for billing. Defender for Cloud coverage uses Defender Experts for Servers. Confirm both licenses and the service scope.
Company details
- Headquarters
- Redmond, Washington