Microsoft Security, Compliance, and Identity Fundamentals SC-900 Practice Question

Microsoft Defender XDR (formerly called Microsoft 365 Defender) brings together signals from several Defender workloads-including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps-to automatically correlate related alerts into a single incident. It can then trigger automated investigation and response actions across the affected assets. Microsoft Sentinel offers SIEM and SOAR capabilities but does not itself provide the cross-workload correlation specific to the Defender products. Azure Active Directory Identity Protection focuses only on identity-related risks, and Azure Firewall is a network security appliance that does not aggregate security signals.