Microsoft Defender for Office 365

In our company of ~2500 users, we use Microsoft Defender for Office 365 on a daily basis, or rather, every minute of the working day. This ranges from monitoring Microsoft Defender for Office 365 for Identity sensors and alerts, to managing blocked/allowed senders, removing email threats that got delivered to users, isolating high-risk devices, releasing emails from quarantine, and much more. Microsoft Defender for Office 365 also gives us insights of vulnerable software within our environment on servers and normal workstations, missing KB' for various CVE's, Alerts for suspicious activity or applications, as well as recommendations and possible solutions for other vulnerabilities found within our network. It integrates nicely with the rest of our domain applications, and we have automated sentinel alerts which triggers for various types of events that one needs to monitor. We have recently implemented MDI which is part of the offerings, and found it to be very useful in terms of monitoring logs and events, and sending alerts to the list of people specified in order for action to be taken. Features that are also very important include Company Secure Score, and exposure score, which provides you with detailed stats and analysis to see trends and do reporting on using PowerBI.

We use the product to provide solution for business and for the end user of different departments. And the scope, it's going to depend which projects we are using that solution. And for some user and also for some countries because we are globally company.

I think the point of the product was to help our bank make sure that their data was protected. So setting up all the categorization, setting up all the rules, setting up the detection and ensuring that no data from the company leaked out from the bank.

It's more like a backend passive tool in the way we use it on top of our own tool, so it's a nice multi-pronged approach. Again, this is for protecting our inbox and everything.

The scope is across all employees. We have a lot of BYOD devices, so bring your own devices is really the main use cases. Lots of remote offices, lots of home offices, so we use the vendor to secure all those devices that are connected to our network.

For authentication purposes, if there are any, we have contractors as well in our company. So we have limited exercise, so we have a certain area that only an assigned person can go into that area. Only for that access to the libraries we use this application.

I would implement this product for other organizations. I would solve their problems by presenting which solution Microsoft offers that would be the best for their organization. My scope would be small businesses.