Microsoft Ignite 2020: The Defender Rebrand and Unified XDR Strategy

Retrospective: this article looks back at events from September 2020, written in 2026 with the benefit of hindsight.

At Microsoft Ignite in September 2020, Microsoft reorganized its security products under a single brand: Microsoft Defender. The change reflected its strategy of extended detection and response (XDR) across identities, endpoints, email, applications and cloud workloads.

What was renamed

• Microsoft Threat Protection became Microsoft 365 Defender.
• Microsoft Defender ATP became Microsoft Defender for Endpoint.
• Office 365 ATP became Microsoft Defender for Office 365.
• Azure ATP became Microsoft Defender for Identity.
• Azure Security Center's threat protection became Azure Defender (later folded into Microsoft Defender for Cloud).

Microsoft Cloud App Security was later renamed Microsoft Defender for Cloud Apps.

Why it mattered

The rebrand signaled integration: correlated incidents across products, a unified portal and automated investigation spanning email, endpoint and identity. For customers already licensed for Microsoft 365 E5, it also highlighted how much security capability they owned.

The practical challenge

Frequent renames caused real confusion. Documentation, licensing guides and internal runbooks used different names for the same products, and the boundaries between products and portals shifted over time. Many organizations struggled to map what they owned to what they had deployed.

In hindsight

The XDR strategy worked: Microsoft 365 Defender became Microsoft Defender XDR, and Microsoft Sentinel moved into the same unified portal. The lesson for customers is practical — focus on capabilities (endpoint detection, email protection, identity threat detection, cloud posture) rather than product names, which will keep changing.