What I like best about Microsoft Defender Experts for XDR is the combination of Microsoft’s threat intelligence, advanced hunting capabilities, and direct access to experienced security analysts.
The service helps validate and prioritize incidents, investigate suspicious activity across identities, endpoints, email, applications, and cloud workloads, and provide clear recommendations for remediation. This is particularly valuable when internal security teams are dealing with alert fatigue or do not have enough time to perform deep investigations.
I also like that the service complements the existing SOC rather than replacing it. It adds specialized expertise, improves detection coverage, and helps security teams respond more quickly and confidently to complex threats. Review collected by and hosted on G2.com.
What I dislike most about Microsoft Defender Experts for XDR is that the service can be expensive and may be difficult to justify for smaller organizations or teams with limited security budgets.
The value also depends heavily on how well Microsoft Defender XDR is already configured. If data connectors, policies, device onboarding, alert tuning, and incident response processes are not mature, the service may not deliver its full potential.
In addition, some recommendations still require internal teams to investigate further, coordinate with other departments, and perform the remediation themselves. The service provides valuable expert guidance, but it does not replace the need for strong internal ownership, operational processes, and security expertise. Review collected by and hosted on G2.com.
