In short
MDR for Microsoft Defender is a managed detection and response service that monitors the Microsoft Defender and Microsoft 365 tools you already license. A vendor's 24/7 SOC, such as Sophos MDR, WatchGuard Core MDR for Microsoft or Blackpoint MDR, investigates Defender alerts and acts on confirmed threats. Forever Systems chooses the service, connects it and manages escalation.
Get a quote for MDR for Microsoft Defender
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Why add MDR to Microsoft Defender?
Many UK organisations already own capable Microsoft security tools through Microsoft 365 Business Premium, E3 or E5, with different Defender components in each plan: Defender for Business or Defender for Endpoint on devices, Defender for Office 365 on email in Business Premium and E5, and Entra ID for identity. Microsoft Defender XDR brings their alerts together.
The technology raises good alerts. The gap is people. A Defender alert at two in the morning on a Saturday needs someone to decide whether it is real, work out what else the attacker touched and act there and then, not on Monday morning. Small IT teams cannot staff that, and an unread alert gives an attacker hours or days.
An MDR service built for Microsoft closes that gap without asking you to rip out what you have paid for:
- Keep your licences: the service watches Defender and Microsoft 365 rather than replacing them
- 24/7 analysts: the vendor's security operations centre triages and investigates alerts around the clock
- Action, not just alerts: within the authority you agree, analysts can isolate devices or lock compromised accounts
- Microsoft 365 coverage: services can watch sign-ins, inbox rules and audit logs, where account takeover usually starts
MDR services that work with Microsoft Defender
These are the vendor services we supply for Microsoft-centred organisations. Each is run by the vendor's own SOC; Forever Systems sets it up, manages it and handles escalation.
| Service | How it uses Microsoft | Notes |
|---|---|---|
| Sophos MDR | Microsoft 365 audit logs and Microsoft Graph Security API alerts at no extra cost, subject to your Microsoft subscriptions; response actions in Microsoft 365 | The Sophos agent can run in detection and response-only mode alongside Defender; see Sophos MDR for Microsoft Defender |
| WatchGuard Core MDR for Microsoft | WatchGuard's SOC monitors endpoints protected by Microsoft Defender for Endpoint, with optional Microsoft 365 monitoring | Needs your own Defender for Endpoint P1 or P2 licence on each endpoint; licensed per user |
| WatchGuard Open MDR | Can use Microsoft Defender as the endpoint source alongside firewalls, identity and cloud tools | For mixed estates |
| Blackpoint MDR | Blackpoint's agent works alongside Microsoft Defender, and its Defender integration lets the SOC watch Defender alerts too | Human-led, AI-assisted SOC that isolates compromised devices; delivered on CompassOne |
| Cisco XDR Premier | Cisco XDR Advantage includes curated third-party integrations such as Microsoft Defender; Premier delivers it as a Cisco-managed service | Suits organisations also running Cisco security; see Cisco XDR |
Which Microsoft alerts a service can see depends on the Microsoft plans you hold. We check your licences before recommending anything, and Forever Group can supply the Microsoft licences you are missing.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What the SOC can do in Microsoft 365
Watching is half the job. The value of MDR for Microsoft comes from analysts being able to act in your tenant when they confirm an attack. Depending on the service and the permissions you grant, response actions can include:
- Blocking a user's sign-in or locking a compromised account
- Revoking a user's active sessions, so a stolen session token stops working
- Turning off malicious inbox rules, a common way attackers hide their activity or forward mail
- Isolating a device so it can no longer reach the rest of the network
For example, Sophos describes its Microsoft 365 response actions as blocking sign-ins, revoking sessions and disabling inbox rules, applied according to the response mode you choose: Authorize (Sophos acts, then tells you), Collaborate (Sophos acts with your consent) or Notify Only (notifications, no containment). If your main worry is stolen credentials and business email compromise, our managed ITDR page goes further into identity detection and response.
Keep Defender, or change the endpoint agent?
You do not have to choose between Defender and MDR, but there are three sensible patterns:
| Approach | When it suits | Example services |
|---|---|---|
| Keep Defender, add MDR on top | You have Business Premium, E5 or Defender for Endpoint P1/P2 and it is well configured | WatchGuard Core MDR for Microsoft, Sophos MDR, Blackpoint MDR |
| Keep Defender and add a second detection agent | You want extra visibility without replacing Defender's prevention | Sophos MDR with its agent in detection and response-only mode; Blackpoint's agent alongside Defender |
| Move to the MDR vendor's endpoint protection | Defender is not licensed everywhere, or you want one vendor for prevention and response | Sophos MDR (Sophos Endpoint protection is included), WatchGuard Core MDR, ThreatDown MDR |
Defender's configuration matters in every case. Tamper protection, attack surface reduction rules and onboarding of every device decide how much the SOC can see. We review that as part of setup, and our managed endpoint security service can keep it in order afterwards.
Is MDR for Microsoft Defender the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Forever Systems sets it up
- We check which Microsoft 365 and Defender licences you hold and how Defender is configured today.
- We recommend one or two MDR services that work with those licences, and explain what each will and will not see.
- A Microsoft 365 administrator grants the vendor's integration the permissions it needs; we guide that step and confirm alerts are arriving.
- We agree response authority with you and the vendor: what analysts may do on their own, and what needs your approval.
- We set up escalation contacts, act as your escalation point when the SOC raises an incident, and review the service with you.
Scope and responsibilities are confirmed at quote. For the wider picture of what gets watched and by whom, see cyber security monitoring services; for an MDR service across more than Microsoft, see managed XDR.
Who it suits
MDR for Microsoft Defender suits organisations that have standardised on Microsoft 365 and want round-the-clock cover without paying twice for endpoint protection. Typical triggers are a cyber insurance questionnaire asking about 24/7 monitoring, a customer security review, or a phishing incident that went unnoticed for too long.
It is also a sensible step for small businesses on Business Premium, where Defender for Business is already included. Pricing depends on the service, your user and device numbers and any add-ons, so ask us for a quote and contact us.
How Forever Systems helps with managed security
We do not run our own security operations centre. The round-the-clock monitoring, investigation and response come from managed detection and response services that established security vendors already run at scale. Our part is choosing the right one for you, setting it up properly and staying involved.
- Independent recommendation: we supply several vendor MDR, XDR and SIEM services, including Sophos MDR, Check Point MDR and Cisco XDR, so we can suggest the one that fits the tools you already own
- Setup and onboarding: we can deploy agents, connect integrations such as Microsoft 365 and work with the vendor through tuning
- Clear responsibilities: escalation contacts, response permissions and who does what are agreed with you in writing and confirmed at quote
- Ongoing management: we help with policy changes, exclusions, renewals and regular service reviews
- Wider security too: security awareness training, Cyber Essentials and cloud security advice
We work with businesses, schools, charities and public sector organisations across the UK.
Frequently asked questions
Can I get MDR for Microsoft Defender without replacing it?
Yes. Services such as WatchGuard Core MDR for Microsoft, Sophos MDR and Blackpoint MDR work with Microsoft Defender rather than replacing it. Their analysts investigate Defender alerts and act within the permissions you agree.
Does MDR for Microsoft 365 cover email and sign-ins?
It can. Sophos MDR takes Microsoft 365 audit logs and Microsoft Graph Security API alerts at no extra cost, subject to your Microsoft subscriptions, and can block sign-ins, revoke sessions and turn off inbox rules. Coverage varies by service and by the Microsoft plans you hold.
What Microsoft licence do I need for WatchGuard Core MDR for Microsoft?
Each endpoint needs its own Microsoft Defender for Endpoint P1 or P2 licence, which you license separately. WatchGuard licenses Core MDR for Microsoft per user.
Is Microsoft Defender for Business enough on its own?
Defender for Business is capable protection, but it does not include people watching alerts around the clock. If nobody can respond at night or at weekends, adding an MDR service is usually the practical way to get that cover.
How much does MDR for Microsoft Defender cost?
It depends on the service, the number of users or devices, the data sources and any add-ons such as identity detection. Ask us for a quote and we will compare the options that fit your licences.
Still have a question about MDR for Microsoft Defender?
Ask us and a member of our team will reply by email.