Microsoft Threat Protection On By Default

• The new Microsoft Threat Protection console will be on by default starting June 1, 2020.
• It will help Microsoft 365 customers respond to attacks by integrating data from multiple Microsoft security services and automating responses.
• The service could bring license compliance challenges.

Microsoft Threat Protection (MTP) is not a new suite or license but instead a new brand and console. The brand unifies the three existing Advanced Threat Protection (ATP) services from the Microsoft 365 E5 suite within one integrated console. This integration brings new benefits. However, its planned June 1, 2020, launch could also create new license compliance challenges.

Service Overview

The MTP-branded console combines related threat information into “incidents” across the following three services:

• Defender ATP (endpoint security)
• Office 365 ATP (mail and document security)
• Azure ATP (identity security).

The integration allows one service to inform other related services of actions that should be taken. MTP offers automated investigation and response actions and playbooks that combine analysis, reports, and remediation actions for responding to specific types of problems. For example, if Microsoft Defender ATP finds a malicious executable on protected endpoints, it can provide information to Office 365 ATP, which can immediately scan for other instances of this file and remove them from e-mail messages. Administrators can also use log data query and other hunting tools across all three ATP services during investigations, which can help them understand the broader picture of a threat event.