isitdownrightnow.app
  1. Home
  2. Services
  3. Microsoft Defender XDR
Microsoft Defender XDR microsoft.com

Is Microsoft Defender XDR down right now? Live status and outage tracker

No, Microsoft Defender XDR is up.

No outage detected, and no user reports in the last hour.

Live Data refreshes every 5 minutes
Not working for you? Official status pageStatus page
User reports, last 24 hours, 15 minutes a segment: 96 flowing, 0 slow (elevated), 0 jammed (outage)

User reports, last 24 hours

No reports in this window

No problem reports came in for Microsoft Defender XDR in the last hour, and at this time of day there are usually almost none. There has been no spike in reports since 28 October. These are user reports from the UK, where most people report Microsoft Defender XDR problems.

Around the world right now: normal in 65 other countries. Most reports in the last hour: Pakistan 1. By country

No user reports came in for Microsoft Defender XDR in the past 24 hours, and its uptime over that window is 100.00%. No 15-minute window had any reports at all, so the chart above stays flat.
Reports, last hour
0
Quiet
Uptime, 24 h
100.00%
No outage windows
Last outage
None
In the last 24 hours
Busiest 15 minutes
0
No reports
Last 24 hours

Microsoft Defender XDR outages and problems

No user reports came in for Microsoft Defender XDR in the past 24 hours, and its uptime over that window is 100.00%.

No 15-minute window had any reports at all, so the chart above stays flat.

No problems detected in the last 24 hoursReports for Microsoft Defender XDR stayed at their usual level the whole time.
Report categories

What people can report about Microsoft Defender XDR

What went wrong

What people said was wrong in recent problem reports for Microsoft Defender XDR worldwide.

  1. App100%

Share of 1 recent report that said what was wrong, from every country listed below.

World map

Microsoft Defender XDR reports around the world

In the last 24 hours, 6 problem reports about Microsoft Defender XDR came in from 3 countries. Right now reports are at the usual level in every country.

  • Outage now
  • Problems now
  • Normal
Each dot is a group of recent reports, coloured by how its country is doing now; bigger dots, more reports.
CountryNowLast hour24 hours
Pakistan Normal 11
The US Normal 03
Japan Normal 02
Australia Normal 00
Azerbaijan Normal 00
Bahrain Normal 00
Bangladesh Normal 00
Bulgaria Normal 00
Canada Normal 00
Croatia Normal 00
Hong Kong Normal 00
India Normal 00

Each country's status compares its reports with the usual level there. 54 more countries had 0 reports in the last 24 hours. Map outlines: Natural Earth.

Last 30 days

Microsoft Defender XDR problem spikes, last 30 days

Since 28 October, Microsoft Defender XDR had no outage spikes or periods of elevated reports.

  • Sat 3 Oct: no data
  • Sun 4 Oct: no data
  • Mon 5 Oct: no data
  • Tue 6 Oct: no data
  • Wed 7 Oct: no data
  • Thu 8 Oct: no data
  • Fri 9 Oct: no data
  • Sat 10 Oct: no data
  • Sun 11 Oct: no data
  • Mon 12 Oct: no data
  • Tue 13 Oct: no data
  • Wed 14 Oct: no data
  • Thu 15 Oct: no data
  • Fri 16 Oct: no data
  • Sat 17 Oct: no data
  • Sun 18 Oct: no data
  • Mon 19 Oct: no data
  • Tue 20 Oct: no data
  • Wed 21 Oct: no data
  • Thu 22 Oct: no data
  • Fri 23 Oct: no data
  • Sat 24 Oct: no data
  • Sun 25 Oct: no data
  • Mon 26 Oct: no data
  • Tue 27 Oct: no data
  • Wed 28 Oct: 1 report
  • Thu 29 Oct: 5 reports
  • Fri 30 Oct: 0 reports
  • Sat 31 Oct: 0 reports
  • Sun 1 Nov: no data

By country

Each square is one day in the countries with the most reports: red when reports stayed at outage level for half an hour or more, amber when they stayed above the usual level for an hour or more, grey otherwise.

  • The US18
  • The UK5
  • Brazil3
  • Japan3
  • Colombia2
  • Canada1
  • Chile1
  • Spain1

Country history starts on 28 October 2026. Days run from midnight to midnight, Central European time.

A spike is a sharp rise in problem reports from users, kept exactly as this page showed it at the time. This history starts on 28 October 2026. Monthly reports for all services

Troubleshooting

How to fix Microsoft Defender XDR not working

Microsoft Defender XDR is up on our end, so if it won't work for you, the problem is most likely on your side. Work through these in order:

Your browser tries to reach microsoft.com over your own connection, right now. Nothing is sent to us or stored.

  1. Sign out and start a fresh session

    Sign out of the portal, close every tab on it, then sign back in from a private window. Stale session tokens leave incident queues blank and make advanced hunting queries spin without ever returning a result.

  2. Switch to a clean browser profile

    Load the portal in another browser, or in a profile with extensions turned off. Script blockers and old cached files break the alert details pane and the incident timeline more often than people expect; if everything renders there, clear site data in your usual browser and try again.

  3. Confirm your role and licence

    Ask an admin to check your account in the Microsoft 365 admin center for a Defender XDR licence and a security role such as Security Reader. Without the right role, device inventory pages stay hidden and some sections return an access error instead of data. Role changes can take a while to take effect, so retry after a short wait.

  4. Check service health, then open a ticket

    Read the official status page at https://status.cloud.microsoft/ and the Message center in the admin center for any advisory that touches the service. If both are quiet and a colleague on the same tenant sees their data fine, file a support request from the admin center and include the page that fails along with the time it happened. The help centre at https://learn.microsoft.com/en-us/defender/ is worth a look first for known limitations on your platform.

While Microsoft Defender XDR is down: what to use instead

  • Microsoft 365 admin center Check service health and open a support request when the app will not load.
  • Microsoft Sentinel Query logs and triage incidents here if you need to keep investigating alerts while the usual incident queue is unavailable.
  • Microsoft Purview Review data loss and eDiscovery alerts when you need to act on compliance issues without the console.
  • Microsoft Entra admin center Manage sign-in risk and conditional access if the service cannot show identity incidents.
Your device

Fix Microsoft Defender XDR on Windows, Mac, Android and iPhone

Microsoft Defender XDR on Windows

Fix
Clear your web browser's cache to resolve Microsoft Defender XDR portal issues, or restart the Defender service on your PC.
Check
Check if the Microsoft Defender XDR portal is accessible online, or verify the service status in the Microsoft 365 admin center.
Command Prompt
ping microsoft.comTest whether Microsoft Defender XDR's servers reply
nslookup microsoft.comCheck that Microsoft Defender XDR's DNS resolves
tracert microsoft.comTrace where the connection drops
ipconfig /flushdnsClear the DNS cache, then reload

Microsoft Defender XDR on Mac

Fix
Ensure Microsoft Defender XDR has Full Disk Access allowed in macOS System Settings, or restart your browser to clear portal errors.
Check
Check if you can access the Microsoft Defender XDR web console, or verify the connection status within the macOS menu bar app.
Terminal
ping -c 4 microsoft.comTest whether Microsoft Defender XDR's servers reply
nslookup microsoft.comCheck that Microsoft Defender XDR's DNS resolves
traceroute microsoft.comTrace where the connection drops
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderFlush the macOS DNS cache, then reload

Microsoft Defender XDR on Android

Fix
Clear the app cache in your device settings, or update the Microsoft Defender XDR client from the Google Play Store.
Check
Open the mobile app to check for connection errors, or try accessing the Microsoft Defender XDR cloud portal using a mobile browser.

Microsoft Defender XDR on iPhone and iPad

Fix
Re-authenticate your account within the app, or reinstall Microsoft Defender XDR from the Apple App Store to resolve connection issues.
Check
Verify if the app shows a green protection status, or check the Microsoft 365 Service health dashboard for Microsoft Defender XDR outages.
About

What happens when Microsoft Defender XDR goes down

Microsoft Defender XDR is Microsoft's extended detection and response suite, and security operations teams rely on it to correlate alerts across endpoints, identities, email, and cloud apps. An outage interrupts incident triage and automated response work.

The portal often falters first: incident queues load slowly, or a page times out before you can open a case. Advanced hunting queries can time out, and device or identity timelines may show stale data because signals stop merging. Automated investigation and response can stall, so alerts sit unprocessed and containment actions wait. Outages are often partial or regional, which means email filtering may keep working while endpoint alerts and incident correlation fail.

Servers and network

Microsoft Defender XDR IP address, servers and network

IPv4 address
23.52.181.212
IPv6 addresses
2a02:26f0:3500:f84::356e
Show all 3
  • 2a02:26f0:3500:f89::356e
  • 2a02:26f0:3500:f8e::356e
Network
AS16625 · Akamai Technologies, Inc., registered in the United States
Served through
Microsoft Azure Front Door
DNS hosted by
Microsoft Azure DNS
HTTPS certificate
Issued by Microsoft Corporation, valid until 30 Jan 2027 (90 days)
HTTP/3
Not advertised
Our check
Answered in 86 ms

Checked from our server in Frankfurt, Germany, 3 days ago, for www.microsoft.com. A service behind a CDN answers from many data centres, usually the one nearest to you, so these addresses are where its traffic enters, not where its own servers stand. Visitors elsewhere may see different addresses.

Checked from 11 places around the world

None of check-host.net's 11 servers got an answer from www.microsoft.com (connection timed out), but our own check from Frankfurt did, 3 days ago. That usually means the site drops automated checks from those servers, not that it is down.

Checked with check-host.net from 11 cities 3 days ago, for www.microsoft.com.

Questions

Microsoft Defender XDR FAQ

Is Microsoft Defender XDR down right now?
The status at the top of this page shows whether problem reports for the service are above their usual level, counted in 15-minute windows over the last 24 hours. If the official status page listed above shows a service incident, wait for Microsoft to post an update; if it does not, check your side by trying another browser or network and signing out and back in. A coworker on a different network who can open the portal points to a local problem.

Why does the portal show Access denied when I open incidents?
Access denied usually comes from role assignment, and the role that lets you see alerts may not cover incidents or device groups. Ask a Security Administrator to check your unified role in the Defender portal and your Microsoft Entra ID groups; if conditional access applies, confirm your session meets the policy.

My device is missing from Device inventory after onboarding. What should I check?
Check the device's sensor health and confirm it reports to the same tenant, because a device that cannot reach the required Microsoft endpoints will not finish onboarding. Linux and macOS devices need the matching deployment package, and a new device can take a while to appear in the portal.

Why do alerts in Defender for Endpoint not appear as an incident?
Alerts can stay separate when the service has not grouped them into an incident, and filters on the incident queue can hide the rest. Clear the queue filters and open the alert directly to check its incident link and status.

Advanced Hunting returns no rows for an active device. What usually causes that?
The query time range may sit outside the retention window for that table, or the device may not appear in the table you chose. Start with a short range and a table such as DeviceEvents, then confirm your role can run queries.
For your site

Put the Microsoft Defender XDR status badge on your site

Paste one of these into a web page, a blog post or a README. The badge shows the same status as this page, based on user problem reports. Browsers can keep a copy for up to 4 hours. It links back here.

Microsoft Defender XDR status badge, as it looks now

HTML
<a href="https://isitdownrightnow.app/services/microsoft-defender-xdr/"><img src="https://isitdownrightnow.app/badge/microsoft-defender-xdr.svg" alt="Microsoft Defender XDR status" height="20"></a>
Markdown, for README files
[![Microsoft Defender XDR status](https://isitdownrightnow.app/badge/microsoft-defender-xdr.svg)](https://isitdownrightnow.app/services/microsoft-defender-xdr/)

The badge is a plain image: no scripts, no cookies. People who see it on your page load it from our server.

How we track Microsoft Defender XDR

The status on this page comes from user-submitted problem reports for Microsoft Defender XDR, counted in 15-minute windows over the last 24 hours. Each window is compared with the normal level for Microsoft Defender XDR, so a few complaints on a quiet day don't trigger anything, but a sudden jump well above normal does.

When reports climb well above normal, the status here changes to partial outage or major outage and the chart moves with it. This is separate from Microsoft Defender XDR's official status page: user reports tend to show a problem early, while the official page confirms the cause. If the two disagree, check both.

Elsewhere

Check other services

See all 500+ services

Problems elsewhere right now

Strips: user reports, last 6 hours, 15 minutes a segment.