Most mid-size businesses that turn on Microsoft 365 Business Premium or E5 end up with a security portal full of alerts and nobody sure which ones matter. Microsoft Defender XDR incidents are the answer to that noise: instead of fifty separate alerts, you get a handful of correlated stories that tell you what happened, to whom, and on which device. This guide explains how the incident queue works and how a small IT team can run it in about twenty minutes a day.
What an incident actually is
An alert is a single signal. A suspicious sign-in, a malicious attachment, a PowerShell command that looks like credential theft. On its own, each alert tells you very little.
An incident is Defender’s attempt to connect those signals. When Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and Microsoft Entra ID Protection see activity that involves the same user, mailbox, device or IP address within a short window, the portal groups the alerts into one incident. As the attack develops, new alerts are added to the existing incident rather than creating fresh ones.
That matters for a small team. You are not triaging alerts, you are triaging attack stories. A phishing email that was delivered, clicked, followed by a risky sign-in from another country and an inbox rule that forwards mail externally shows up as one incident with four alerts, not four unrelated tickets.
Where to find the queue and what the columns mean
Sign in to the Microsoft Defender portal and go to Investigation & response > Incidents & alerts > Incidents, or open https://security.microsoft.com/incidents directly. By default the queue shows incidents from the last week with a status of New or In progress and a severity of High, Medium or Low.
The columns worth keeping on screen:
Column
Why it matters
Priority score
A 0-100 score Microsoft calculates from severity, attack disruption signals, threat intelligence and asset criticality. Red is above 85, orange 15-85, gray below 15.
Severity
High, Medium, Low or Informational. Useful, but a Medium incident touching your finance director can outrank a High on a test laptop.
Impacted assets
Users, devices and mailboxes involved. The fastest way to judge business impact.
Detection sources
Which Defender product raised the alerts. Multiple sources usually means a more developed attack.
Assigned to
Ownership. Anything unassigned after a day is a process failure.
Tags
Look for the Attack Disruption tag, which means Defender already contained something automatically.
Use Customize columns to add or remove these, and drag them into an order that matches how you work.
A daily triage routine for a small team
In the tenants I review, the most common problem is not missing alerts. It is that nobody owns the queue, so incidents sit in New status for weeks. A short, repeatable routine fixes that.
Sort by priority score. Start at the top. The score already weighs severity, rarity and whether ransomware or account takeover is involved.
Check for Attack Disruption tags first. If Defender disabled a user or contained a device, you need to confirm the action was right and decide when to release it.
Open the incident summary pane. Click the row (not the name) to see the priority reasoning, impacted assets and recommended actions without leaving the queue.
Assign an owner. Even if the owner is you, assign it. That one click turns a list into accountability.
Classify and resolve. When you are done, set the classification (true positive, informational/expected activity, or false positive) and resolve. Resolving an incident resolves its alerts too.
Review anything older than seven days. Stale incidents are either noise you should tune or real problems you forgot.
For a 50-200 seat business, that routine typically fits inside twenty minutes on a normal day. On a bad day it is the difference between catching a compromised mailbox on Monday and discovering it during a vendor payment dispute three weeks later.
Saved filters that save time
The incident queue lets you build filters and save them, either as a filter set or by bookmarking the URL. Build a few once and use them every day:
High severity, unassigned: the first thing to check each morning.
Assigned to me: your personal work list.
Email-related incidents: filter by detection source for Defender for Office 365, useful when phishing waves hit.
Executive and finance users: search by impacted asset for the handful of accounts attackers target most.
Last 30 days, resolved as true positive: the input for your monthly security report.
You can also search the queue by user, device or mailbox name. When a staff member calls to say something odd happened on their laptop, search their device name and you will usually find the incident before they finish explaining.
Reading an incident without getting lost
Inside an incident, the tabs can feel overwhelming. Work through them in this order:
Attack story and summary
Start with the timeline and the incident graph. They show how the alerts connect: which email led to which click, which sign-in led to which mailbox change. If you only read one thing, read this.
Assets
Check the affected users, devices and mailboxes. Ask two questions: is this person privileged, and does this device hold sensitive data? That decides urgency.
Evidence and response
This tab lists files, processes, URLs and email messages tied to the incident, plus any remediation actions. Items marked Pending Action are waiting for an admin to approve them. Approving them here, or in the Action center, is often the fastest way to finish cleanup.
Licensing: what you see depends on what you own
The incident queue exists in every tenant with Defender capabilities, but the depth of what feeds it varies.
Microsoft 365 Business Premium includes Defender for Business for devices and Defender for Office 365 Plan 1 for email. You get correlated incidents across endpoints and email, which is a large step up from antivirus alone.
Microsoft 365 E5 adds Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity and Defender for Cloud Apps. More sources mean richer incidents, plus advanced hunting and automated investigation for email.
Entra ID P2 (included in E5) adds Identity Protection risk detections, which make account-takeover incidents much clearer.
If you are weighing whether the jump to E5 pays for itself, our E5 vs E3 calculator is a quick way to compare.
When to bring in help
Running the queue yourself is realistic for many mid-size firms. It stops being realistic when incidents arrive outside business hours, when you have no one with time to investigate a multi-stage attack, or when the same false positives keep returning and nobody has time to tune them. That is the point where a managed security service earns its fee, with someone watching the queue around the clock and escalating only what needs a business decision.
It also helps to make sure every endpoint is actually onboarded. An incident queue that only sees half your laptops gives a false sense of calm. Our Defender for Endpoint deployment work usually starts by closing that gap.
What is the difference between an alert and an incident in Defender XDR?
An alert is a single detection, such as a malicious file or a risky sign-in. An incident is a group of related alerts that Defender correlates because they share users, devices, mailboxes or timing. You should triage incidents, then drill into alerts only when you need detail.
How often should a small business check the Defender incident queue?
At least once every business day, and ideally with alert email notifications for high severity incidents so urgent issues reach you outside that window. If nobody can commit to daily review, that is a strong sign you need a managed service watching it.
Do Microsoft Defender XDR incidents require E5?
No. Business Premium tenants see correlated incidents from Defender for Business and Defender for Office 365 Plan 1. E5 adds more data sources, such as Defender for Identity and Defender for Cloud Apps, which make incidents more complete.
Not sure whether your incident queue is telling you the whole story? Book a free Microsoft 365 security assessment and we will review your Defender coverage, onboarding gaps and alert hygiene with you.
Most mid-size businesses that turn on Microsoft 365 Business Premium or E5 end up with a security portal full of alerts and nobody sure which ones matter. Microsoft Defender XDR incidents are the answer to that noise: instead of fifty separate alerts, you get a handful of correlated stories that tell you what happened, to whom, and on which device. This guide explains how the incident queue works and how a small IT team can run it in about twenty minutes a day.
What an incident actually is
An alert is a single signal. A suspicious sign-in, a malicious attachment, a PowerShell command that looks like credential theft. On its own, each alert tells you very little.
An incident is Defender’s attempt to connect those signals. When Defender for Endpoint, Defender for Office 365, Defender for Identity, Defender for Cloud Apps and Microsoft Entra ID Protection see activity that involves the same user, mailbox, device or IP address within a short window, the portal groups the alerts into one incident. As the attack develops, new alerts are added to the existing incident rather than creating fresh ones.
That matters for a small team. You are not triaging alerts, you are triaging attack stories. A phishing email that was delivered, clicked, followed by a risky sign-in from another country and an inbox rule that forwards mail externally shows up as one incident with four alerts, not four unrelated tickets.
Where to find the queue and what the columns mean
Sign in to the Microsoft Defender portal and go to
Investigation & response > Incidents & alerts > Incidents, or openhttps://security.microsoft.com/incidentsdirectly. By default the queue shows incidents from the last week with a status of New or In progress and a severity of High, Medium or Low.The columns worth keeping on screen:
Use Customize columns to add or remove these, and drag them into an order that matches how you work.
A daily triage routine for a small team
In the tenants I review, the most common problem is not missing alerts. It is that nobody owns the queue, so incidents sit in New status for weeks. A short, repeatable routine fixes that.
For a 50-200 seat business, that routine typically fits inside twenty minutes on a normal day. On a bad day it is the difference between catching a compromised mailbox on Monday and discovering it during a vendor payment dispute three weeks later.
Saved filters that save time
The incident queue lets you build filters and save them, either as a filter set or by bookmarking the URL. Build a few once and use them every day:
You can also search the queue by user, device or mailbox name. When a staff member calls to say something odd happened on their laptop, search their device name and you will usually find the incident before they finish explaining.
Reading an incident without getting lost
Inside an incident, the tabs can feel overwhelming. Work through them in this order:
Attack story and summary
Start with the timeline and the incident graph. They show how the alerts connect: which email led to which click, which sign-in led to which mailbox change. If you only read one thing, read this.
Assets
Check the affected users, devices and mailboxes. Ask two questions: is this person privileged, and does this device hold sensitive data? That decides urgency.
Evidence and response
This tab lists files, processes, URLs and email messages tied to the incident, plus any remediation actions. Items marked Pending Action are waiting for an admin to approve them. Approving them here, or in the Action center, is often the fastest way to finish cleanup.
Licensing: what you see depends on what you own
The incident queue exists in every tenant with Defender capabilities, but the depth of what feeds it varies.
If you are weighing whether the jump to E5 pays for itself, our E5 vs E3 calculator is a quick way to compare.
When to bring in help
Running the queue yourself is realistic for many mid-size firms. It stops being realistic when incidents arrive outside business hours, when you have no one with time to investigate a multi-stage attack, or when the same false positives keep returning and nobody has time to tune them. That is the point where a managed security service earns its fee, with someone watching the queue around the clock and escalating only what needs a business decision.
It also helps to make sure every endpoint is actually onboarded. An incident queue that only sees half your laptops gives a false sense of calm. Our Defender for Endpoint deployment work usually starts by closing that gap.
For the full list of filters and columns, Microsoft documents the queue in Prioritize incidents in the Microsoft Defender portal.
Frequently asked questions
What is the difference between an alert and an incident in Defender XDR?
An alert is a single detection, such as a malicious file or a risky sign-in. An incident is a group of related alerts that Defender correlates because they share users, devices, mailboxes or timing. You should triage incidents, then drill into alerts only when you need detail.
How often should a small business check the Defender incident queue?
At least once every business day, and ideally with alert email notifications for high severity incidents so urgent issues reach you outside that window. If nobody can commit to daily review, that is a strong sign you need a managed service watching it.
Do Microsoft Defender XDR incidents require E5?
No. Business Premium tenants see correlated incidents from Defender for Business and Defender for Office 365 Plan 1. E5 adds more data sources, such as Defender for Identity and Defender for Cloud Apps, which make incidents more complete.
Not sure whether your incident queue is telling you the whole story? Book a free Microsoft 365 security assessment and we will review your Defender coverage, onboarding gaps and alert hygiene with you.