MS-102: Working Incidents in Defender XDR

A suspicious email, a newly created inbox forwarding rule, and a series of endpoint alerts can look like three separate support requests. In an actual attack they may be connected: an employee opened a malicious message, a session was abused, and the intruder established a way to collect future correspondence. An administrator investigating Microsoft 365 needs to recognize when workload-specific events form one incident and when they only happen to occur close together.

MS-102 includes managing security and threats through Microsoft Defender XDR, with related work in Defender for Office 365, Defender for Endpoint, and Defender for Cloud Apps. Microsoft’s April 2026 study guide is the appropriate outline for this exam during its final availability window; Microsoft says MS-102 retires on November 30, 2026. The technical work, however, is broader than one examination or console interface.

Start with the incident record, then test its story

Defender XDR can correlate alerts and entities into incidents, reducing the need to navigate several products independently. Correlation is useful but not infallible. A grouped incident can include activity unrelated to the initial attack, while another event may remain unassociated because telemetry was unavailable. Investigators should inspect the timeline, affected identities and devices, alert evidence, and the detection logic that produced each finding.

For the suspicious-email scenario, establish the first observable event. Was the message delivered? Did the employee open a link or attachment? Is there a corresponding risky sign-in, process execution, or unusual mailbox action? An incident summary may provide a starting hypothesis, but the supporting records should be examined before selecting a tenant-wide response.

Prioritization should reflect the exposed assets and observed behavior. An incident affecting a privileged account and a confidential executive mailbox deserves different urgency from a blocked commodity attachment that never executed. Escalation should identify what is confirmed, what remains unverified, and which service owners need to participate. Closing a case because an automatic verdict looks reassuring is not a substitute for understanding the consequence of the event.

Email protection needs layered interpretation

Defender for Office 365 provides controls for malicious mail and collaboration threats, including threat policies, alerting, and investigation workflows. Exchange Online Protection and associated filtering layers may assess sender authentication, content, attachments, reputation, and transport characteristics. Their signals have limitations. A message can authenticate correctly and still contain a malicious request when the sending account itself was compromised.

Safe Links and Safe Attachments address specific classes of risk, but their availability and behavior depend on the subscription and policy configuration. A user may receive different protection based on group, policy scope, and the workload where the link is opened. Analyze reports and message traces to establish which controls applied. Broadly weakening a policy to allow one business message creates an avoidable opening for other messages sharing a sender or domain.

When investigating a campaign, look beyond the originally reported message. Are related emails present in other mailboxes? Did some users click a link? Did the attack change its destination after delivery? Remediation may include quarantining messages, blocking indicators, invalidating compromised sessions, or reviewing forwarding rules. Each action should preserve enough evidence for later analysis and avoid disrupting legitimate traffic unnecessarily.

Attack simulations measure behavior, not just click rates

Training campaigns can help organizations understand how employees interact with suspicious messages. A single simulated-phishing click rate tells little about whether users reported concerns promptly, recognized suspicious context, or changed behavior after instruction. Simulations should be ethical, proportionate, and coordinated with the people responsible for staff communications and privacy.

Different roles face different threats. Finance teams encounter supplier-payment fraud; administrators are attractive targets for credential phishing; executives may receive tailored impersonation. Training that teaches only to identify spelling errors will not prepare employees for convincing messages sent from genuinely compromised partner accounts. Use results to improve processes, reporting paths, and verification of unusual requests, not merely to rank employees by a metric.

The operational connection matters: a good reporting culture can supply early evidence for Defender investigations, while response teams should close the loop so reporters know their concerns were handled. People are part of the detection system, not just potential points of failure.

Endpoint protection adds process and device evidence

Microsoft Defender for Endpoint can provide device inventory, attack-surface reduction capabilities, alert evidence, vulnerability context, and response workflows when configured and licensed appropriately. Onboarding and healthy reporting are prerequisites for coverage. A laptop omitted from device management or unable to reach required services can become a blind spot even if a security policy exists on paper.

Consider an endpoint alert showing a suspicious script. Determine its parent process, command arguments, file origin, user context, and connections. Did the script run as part of an authorized IT deployment, or did it follow a malicious attachment? Blocking a hash without analyzing the persistence and credential activity may stop one artifact while leaving the compromise active. Endpoint security needs incident reasoning rather than reflexive execution of a quarantine action.

Vulnerability Management data can reveal unsafe versions and configurations, but priorities should consider exposure and function. A critical vulnerability on an internet-facing privileged service may need rapid action, while a finding on a tightly isolated development asset may receive a controlled maintenance window. Remediation may involve endpoint policy, application update, or system rebuild depending on the threat and operational constraints.

Cloud application visibility catches activity outside the mailbox

Defender for Cloud Apps helps organizations examine connected cloud-service behavior under supported configurations. App connectors, discovery data, and cloud application policies can add visibility into unauthorized applications, suspicious sessions, or risky information movement. Yet a discovery signal from one network location does not mean every remote or unmanaged device was observed.

An employee may authorize an unfamiliar application to read Microsoft 365 data. That event does not always indicate an attack; it may be a legitimate workflow introduced without proper review. Investigators should inspect publisher identity, requested permissions, user intent, sign-in context, and actual activity before choosing revocation. A compromised or malicious application grant can expose data even without a traditional malware process on the endpoint.

Cloud activity logs need context from directory, mail, and endpoint systems. A token grant shortly after a phishing message can be more significant than the same grant during a documented software rollout. Security teams should maintain an application-consent review process rather than waiting for one alert to reveal a new dependency.

Advanced hunting works best when the question is specific

Advanced hunting allows investigators to query supported telemetry and look for behavior not already summarized by an alert. A useful question might ask which devices launched a suspicious command after interacting with a particular message, or which accounts changed mailbox permissions within a defined period. Define the relevant entities, times, and expected fields before writing a query.

A query result is evidence of what the available dataset contains, not proof that an event never occurred elsewhere. Retention and product licensing can affect which records exist. Device names and user identities can change, and event time may differ from collection time. Confirm that your joins, filters, and time windows do not silently exclude the very records you are trying to find.

Hunting should inform response decisions. If three affected accounts share a malicious application consent, the security team may have a common remediation path. If one device shows unrelated administrative activity, treat it separately instead of forcing the evidence into a single campaign. Write down both the confirmed connection and the limits of the available data.

Response actions must preserve the path to recovery

Containment may involve revoking sessions, restricting an account, isolating a device, or changing application permissions. These measures have different side effects. Disabling a synchronization service account can interrupt business-critical integrations; isolating a device can complicate remote evidence collection; removing a token grant may break a legitimate application used by many employees. Choose the smallest effective intervention consistent with threat urgency.

Work through identity recovery, endpoint integrity, mail configuration, and cloud access in a coordinated order. Resetting a password may not be enough if active sessions or application credentials persist. Restoring a workstation from a known-good image helps only after the attacker’s route into the account or network has been closed. Escalation should include service owners who can validate that critical workflows work after remediation.

Secure Score and exposure metrics can guide improvements, but they cannot certify that a specific incident has ended. A higher score is not a forensic conclusion. Evidence of restored controls, removal of attacker access, tested service behavior, and improved monitoring is more persuasive than a dashboard value.

Close the incident with a correction the organization can keep

In the combined-email-and-endpoint example, post-incident work may reveal that application-consent permissions were too broad, a subset of devices failed to onboard, and staff did not know how to report unusual mailbox behavior. Each finding belongs to a named owner with a measurable correction. The case should record what was known at decision time and where visibility was incomplete.

A useful MS-102 candidate can connect protection policies to investigation and service recovery. An analyst preparing for SC-200 may go deeper into hunting and security-tool response, whereas an MS-102 administrator also has to preserve working identities and services as containment and recovery proceed. Related endpoint administration and security operations fundamentals in CySA+ deepen individual parts of the process, but the Microsoft 365 administrator must see their interactions. The practical benchmark is not how many alerts the team closes. It is whether a credible incident can be reconstructed, contained, and resolved without leaving the same weakness ready for the next attacker.