Microsoft Defender Portal Guide: What Each Section Does and What to Check Weekly

The short version: The Microsoft Defender portal at security.microsoft.com is the single place where Microsoft 365 security alerts, incidents, email protection, device protection, reports and policies live. It was called Microsoft 365 Defender before. You only see the sections your licences include. A short weekly routine covers five checks: incidents and alerts, quarantine and submissions, the action center, the email security reports, and Secure Score.

This guide is for the IT admin who has just been told "check the Defender portal" and wants to know where to click and what matters. After reading it you will know what each menu section is for, which roles you need, and a repeatable weekly check. Menu names were checked against Microsoft Learn on 28 October 2026. Microsoft updates the portal often, so a menu may sit slightly differently on your screen.

What the portal is, and what it is called

The Microsoft Defender portal combines protection, detection, investigation and response across your organisation in one place. Microsoft Defender XDR is the service behind it that correlates signals from Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and other Microsoft security products. Older articles and many admins still say "Microsoft 365 Defender"; Microsoft Learn now says "Microsoft Defender portal".

Two points to remember:

• The portal shows only features your subscription includes. If you have Defender for Office 365 but not Defender for Endpoint, you will see email features but not device protection.
• Defender correlates signals from the Microsoft security products you have licensed and provisioned. Unlicensed products add no data.

To see what you license, read Microsoft 365 E3 vs E5 vs EMS security features.

Who can sign in

Open security.microsoft.com with a work account that has a suitable role. Roles that work for most of the pages below include Security Reader and Global Reader for read-only access, and Security Administrator for changes. Prefer the least privileged role. Email policy pages also accept the Organization Management role group, and the Defender portal supports its own Unified role-based access control under Permissions.

The sections of the portal

Home

Summary cards about your security status. Use Add cards to choose what you see. A guided tour is available.

Investigation & response

• Incidents & alerts: alerts are single detections; incidents group related alerts into one attack story across email, devices and identities. This is your daily work queue.
• Hunting: advanced hunting with Kusto Query Language (KQL), and custom detection rules built from queries.
• Actions & submissions: the Action center shows investigations and actions created by automated investigation and response. Submissions lets you send emails, attachments and URLs to Microsoft for analysis, and review messages users reported as junk or phishing.

Threat intelligence

• Threat analytics: reports from Microsoft researchers on active threat actors, new techniques, vulnerabilities and malware, with the related incidents.

Email & collaboration

Usually present when you have Defender for Office 365 or the built-in email protections; what you see depends on your licence.

• Investigations and Explorer: Plan 2 only. Plan 1 has Real-time detections instead of Explorer.
• Review: Quarantine (admin view of held messages and files), Restricted entities (users or connectors blocked for suspected compromise), Malware trends, and the Action center for Plan 2.
• Campaigns and Threat trackers: Plan 2 only.
• Exchange message trace: find out what happened to a message.
• Attack simulation training: Plan 2 only.
• Policies & rules > Threat policies: Preset Security Policies and Configuration analyzer (Templated policies); anti-phishing, anti-spam, anti-malware, Safe Attachments and Safe Links (Policies); Tenant Allow/Block List, Email authentication settings (DKIM and ARC), Advanced delivery, Enhanced filtering and Quarantine policies (Rules). Alert policies also sit here.

See Exchange Online Protection settings for recommended values and Defender for Office 365 Plan 1 vs Plan 2 for what is Plan 2 only.

Other sections you may see

Depending on your licences, further sections appear. Microsoft's Learn pages for Defender for Endpoint in the Defender portal describe these:

• Assets > Devices: the device inventory.
• Endpoints > Vulnerability management and Configuration management: software vulnerabilities, recommendations and device configuration findings (Defender for Endpoint Plan 2 includes the core vulnerability management capabilities).
• Identity and cloud app sections depend on Defender for Identity and Defender for Cloud Apps licences. If you do not have those licences you will not see them.

Menu labels can differ slightly by licence and by portal version, so confirm the names on your own screen.

Reports and System

• Reports > Email & collaboration > Email & collaboration reports: email security report and Defender for Office 365 reports.
• System > Audit: audit log search and audit log retention policies.
• System > Permissions: Defender Unified RBAC, Microsoft Entra roles (view only here) and Email & collaboration roles.
• System > Health: Service health and Message center.
• System > Settings > Microsoft Defender XDR: Defender XDR email notifications for incidents, alert tuning, streaming API; under Email & collaboration: user reported settings, user tags, and for Plan 2, priority account protection and Teams protection.

The five checks to make every week

1. Incidents & alerts. Go to Investigation & response > Incidents & alerts > Incidents. Sort by severity and look at anything high severity, anything active with several alert sources, and anything with no owner. New incidents start with no owner. Open Manage incident, set Assign to (one user or group), change Status from Active to In progress, and when finished choose Resolved and write a resolution note. Set Classification to True positive, Informational, expected activity or False positive. Microsoft notes that incident cases are in preview and are now the recommended experience; the steps above describe the legacy queue and the labels are similar. A good end-of-week target is zero unowned high-severity incidents.
2. Quarantine and Submissions. In Email & collaboration > Review > Quarantine, look for legitimate mail held back and release what is safe. In Actions & submissions > Submissions, review what users reported and resubmit wrong verdicts to Microsoft. A pattern of the same sender or domain being held is a sign to review your policies.
3. Action center. Go to Actions & submissions > Action center and check the investigations and actions created by automated investigation and response. Review anything still pending so nothing waits. In Defender for Office 365 the Action center is a Plan 2 feature, so on Plan 1 this check does not apply to email.
4. Email security reports. Open Reports > Email & collaboration > Email & collaboration reports. Compare this week to last week for malware, phishing and spam, and note any sudden change in volume.
5. Secure Score and configuration drift. Open Microsoft Secure Score at security.microsoft.com/securescore and review new recommended actions. Then open Configuration analyzer and the Configuration drift analysis and history tab to see who changed threat policies and whether the change weakened them. Drift analysis needs unified auditing turned on. See how to improve Microsoft Secure Score.

Once a month, add Threat intelligence > Threat analytics and ask whether any listed threat applies to you.

Common mistakes

1. Looking only at alerts. Alerts are fragments. Work from incidents, which join them.
2. Closing incidents without classifying them. Microsoft says classifying incidents helps tune Defender to detect better over time.
3. Nobody owns the portal. Name one person and one deputy, and put the weekly review in a calendar.
4. Expecting Plan 2 pages on Plan 1. Explorer, Campaigns, Threat trackers, Attack simulation training and Investigations are Plan 2 only. A missing menu usually means a missing licence.
5. Giving everyone Global Administrator to view it. Use Security Reader or Global Reader for read-only work.
6. Ignoring configuration drift. A policy quietly weakened by a well-meaning change does not raise an alert.

How to check it worked

1. A named person can sign in to security.microsoft.com and open each of the five weekly pages.
2. Your incident queue has no unassigned high-severity incident older than a week.
3. You can explain from the Quarantine page why the last three released messages were released.
4. The drift tab shows who made each recent policy change.
5. The weekly review is recorded, even if the record is one line saying nothing needed action.

FAQ

Is there a Microsoft Defender portal?

Yes. It is at security.microsoft.com and was formerly called Microsoft 365 Defender. It brings Defender XDR and other Microsoft security services into one place.

What is the Microsoft 365 Defender portal URL?

security.microsoft.com. For the Configuration analyzer go to security.microsoft.com/configurationAnalyzer and for Secure Score security.microsoft.com/securescore.

How do I know if an email from Microsoft security is real?

General advice, not a Microsoft feature: do not sign in from a link in an unexpected email. Type security.microsoft.com yourself, or use the Microsoft 365 admin center, and check the same message or alert there.

What is the difference between Defender for Endpoint Plan 1 and Plan 2?

Plan 1 gives core endpoint protection such as next-generation anti-malware, attack surface reduction rules, device control, firewall and network protection. Plan 2 adds endpoint detection and response, automated investigation and remediation, vulnerability management, threat analytics and a sandbox.

What is the difference between Defender for Office 365 Plan 1 and Plan 2 in the portal?

Plan 1 has Safe Attachments, Safe Links and Real-time detections. Plan 2 adds Threat Explorer, Campaigns, Threat trackers, automated investigation and response, and Attack simulation training.

Related: the Microsoft 365 security checklist.

If you would rather have a team watch these pages for you every day, see our security operations center (SOC) service.

If you would rather know the price of a full review before you start, what a Microsoft 365 security audit costs sets out the fixed prices by headcount.