Describe Microsoft 365 apps and services →mediumMultiple Choice

MS-900 Describe Microsoft 365 apps and services Practice Question

Your company has deployed Microsoft Defender XDR. A security analyst needs to investigate a suspicious email that was reported by a user. Which Microsoft 365 service should the analyst use to view the email's details and analyze threats?

⚠ Common exam trap

Watch out — candidates often confuse Microsoft Sentinel (a SIEM) with Microsoft Defender XDR (an XDR solution), not realizing that email investigation is a core function of Defender for Office 365 within Defender XDR, not Sentinel.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Microsoft Defender XDR

Microsoft Defender XDR (Extended Detection and Response) is the correct service because it provides a unified investigation and response experience across email, endpoints, identities, and cloud apps. The security analyst can use the Microsoft Defender portal (security.microsoft.com) to view the full email details, including headers, attachments, URLs, and threat analysis results from automated investigation and advanced hunting queries.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Microsoft Sentinel
Why it's wrong here
Microsoft Sentinel is a cloud-native SIEM and SOAR platform that aggregates logs from many sources, including email security telemetry, but it does not host the dedicated email threat investigations users would perform in Defender XDR. Sentinel requires custom analytics rules and connectors to correlate email attack chains, whereas Defender XDR already provides a unified incident queue, attack story, and investigation experience for email-borne threats. Thus, while Sentinel can support advanced hunting and response, it is not the primary email investigation tool here.
✓
Microsoft Defender XDR
Why this is correct
Microsoft Defender XDR is the unified security operations platform that correlates signals from emails, endpoints, identities, and collaboration tools into a single incident queue, enabling teams to investigate the full attack story of email threats such as phishing and malware. It natively relies on Defender for Office 365 for mail-flow protection, URL and attachment detonation, campaign views, and automated investigation and response for email incidents. Therefore, Defender XDR is the correct service for investigating email security incidents in a Microsoft 365 deployment.
✗
Microsoft Intune
Why it's wrong here
Microsoft Intune is a cloud-based unified endpoint management (UEM) and mobile device management (MDM) solution that controls device compliance, application deployment, and configuration policies—not the investigation of email threats. While Intune-managed endpoints can send signals to Defender for Endpoint, Intune itself offers no threat hunting, email message trace, or incident management capabilities within the Defender XDR portal. Its role is device lifecycle management, not security operations center incident response.
✗
Microsoft Purview
Why it's wrong here
Microsoft Purview is a compliance, data security, and governance suite that helps classify, label, and manage data lifecycle and data-loss prevention requirements, rather than email threat investigation. Although Purview can enforce retention and eDiscovery policies on mailbox data, it does not perform message-level detonation, malicious URL verdicting, or campaign tracing, which Defender XDR uses to investigate an email attack. So Purview is relevant to compliance and legal holds, not security incident research.

Go deeper

MS-900 Describe Microsoft 365 apps and services Practice Question

Why each option matters

Option-by-option breakdown

Related to this question