NIST CSF 2.0 mapped to the Microsoft Defender suite

A lot of companies own the full Microsoft security stack and still can’t say what it protects. They pay for Defender for Endpoint, Defender for Office 365, Entra ID Protection, Purview, and Sentinel, and when someone asks a simple question about coverage, the room goes quiet. I ran into exactly that, so I sat down and lined the whole Defender suite up against the six jobs in NIST CSF 2.0. This post is the result. You’ll see what each tool covers, where two or three of them do the same work, and the one job you’ll still have to handle on your own.

The whole map on one page

NIST CSF 2.0 function	What the job is	Microsoft tools that carry it
Govern	Decide how security is run: who owns it, the policies, how risk and suppliers are handled.	Purview Compliance Manager, Microsoft Secure Score, Entra ID Governance
Identify	Know what you have and what could go wrong: assets, data, exposure, vulnerabilities.	Defender for Cloud, Defender EASM, Defender Vulnerability Management, Purview data map
Protect	Put up the guardrails so attacks are harder: access, hardening, data, training.	Entra Conditional Access, Intune, Purview Information Protection and DLP, ASR rules, Attack Simulation Training
Detect	Notice when something is wrong: monitoring and analysis across the estate.	Defender XDR, Defender for Identity, Microsoft Sentinel, Entra ID Protection
Respond	Do something about it: contain, investigate, communicate, fix.	Defender XDR automated response, Sentinel playbooks, Security Copilot
Recover	Get back to normal: restore data and services, communicate during recovery.	Microsoft 365 Backup, Purview retention, and a gap you fill yourself

The rest of the post walks through it, one function at a time.

A quick word on NIST CSF 2.0

NIST CSF is a cybersecurity framework from the US National Institute of Standards and Technology. Think of it as a checklist of the jobs a company needs to do to stay safe, written in a way that works for any size of business. Version 2.0 came out in 2024 and it groups everything into six functions.

Govern: how you run security as a business. Who is responsible, what the policies are, how you measure risk, and how you handle the risk that comes from your suppliers.
Identify: knowing what you have and what could go wrong. Your devices, your data, your accounts, and the weak spots in all of them.
Protect: the guardrails that make an attack harder. Access control, device hardening, data protection, and training your people.
Detect: noticing when something is wrong. Watching your logs and signals for the sign that an attacker is inside.
Respond: doing something once you spot a problem. Containing it, investigating it, telling the right people, and cleaning it up.
Recover: getting back to normal. Restoring the data and the systems, and keeping people informed while you do it.

Govern is the big change in 2.0. Older versions treated leadership and risk decisions as a side note, and now they sit at the center, wrapped around the other five. Microsoft never built its products to match this list, so the map is not obvious. Let’s build it one function at a time.

Govern

The job here is mostly about people and decisions, so no tool does it for you. What the Microsoft tools give you is evidence and a way to keep score.

Microsoft Secure Score gives your tenant a running number that goes up as you turn on the right settings. It is the fastest way to see, at a glance, how well configured you are.
Purview Compliance Manager tracks how you are doing against real frameworks and regulations, control by control, with the evidence attached. This is what you show an auditor.
Entra ID Governance handles the access side of governance: access reviews, entitlement management, and joiner-mover-leaver lifecycle, so people only keep the access they should.

These tools support good governance, but the policies, the ownership, and the risk appetite are decisions your leadership has to make. Keep that expectation clear with anyone who thinks buying a license covers this function.

Identify

You can’t protect what you don’t know you have, so this function is about visibility.

Microsoft Defender for Cloud keeps an inventory of your cloud resources and scores their security posture, so you know what is running and how exposed it is.
Defender External Attack Surface Management (EASM) shows you what the internet can see of your company. It finds the forgotten domain, the exposed server, the thing you didn’t know was public.
Microsoft Defender Vulnerability Management finds the missing patches and weak configurations on your devices and software, and ranks them so you fix the ones that matter first.
On the data side, the Purview data map discovers and classifies where your sensitive information lives, which is its own kind of asset inventory.

Protect

This is the busiest function, and for good reason. It is where you actually stop most attacks from working.

Entra Conditional Access is the gatekeeper for sign-ins. It decides who can get in, from what device, from where, and whether they need to prove themselves again. Pair it with phishing-resistant methods like passkeys and it becomes the single most valuable control you own.
Microsoft Intune makes sure the devices connecting to your data are healthy and configured the way you want, and it can block the ones that are not.
Purview Information Protection and Data Loss Prevention label your sensitive files and stop them from walking out the door by email, upload, or copy.
Attack Surface Reduction rules inside Defender for Endpoint switch off the risky behaviors’ attackers rely on, like Office apps spawning scripts.
Attack Simulation Training in Defender for Office 365 covers the awareness and training part, so your people learn to spot a phishing email before a real one lands.

Detect

Here is where the overlap gets real. Several tools all claim to detect, and understanding how they fit together is half the value of this whole exercise.

Microsoft Defender XDR is the brain that correlates signals across your endpoints, identities, email, and cloud apps, then stitches them into a single incident instead of a pile of separate alerts.
Microsoft Defender for Identity watches your identity layer, including on-premises Active Directory, for the moves attackers make once they have a foothold.
Entra ID Protection scores sign-ins and users for risk, flagging the login that looks like it came from an attacker.
Microsoft Sentinel is the SIEM. It collects logs from everywhere, including your non-Microsoft systems, and lets you write your own detections and keep data for the long term.

Microsoft has been merging Sentinel and Defender XDR into one place they call unified security operations, run from the Defender portal. That helps, but you still make a choice. Defender XDR is your default for anything inside the Microsoft world and it works out of the box. Sentinel is what you add when you need to pull in the rest of your environment, write custom detection logic, or hold logs for compliance. You do not need both fighting over the same alert. Let XDR own the Microsoft signals and let Sentinel own the breadth.

Respond

Once you have detected something, this function is about acting on it quickly and consistently.

Defender XDR can respond on its own. Its automated attack disruption can isolate a device or disable an account in the middle of an attack, before an analyst even picks up the case.
Sentinel playbooks (built on Logic Apps) automate the repetitive steps: open the ticket, notify the channel, block the address, gather the context.
Microsoft Security Copilot sits on top and speeds up the human part, summarizing an incident and suggesting next steps in plain language so triage takes minutes instead of an afternoon.

Notice that these live in the same portal as your detection tools, which is why Detect and Respond feel like one motion in day to day work even though the framework separates them.

Recover

This is the thin one, and it is the honest reason I wrote the post. Microsoft gives you a start here and not much more.

Microsoft 365 Backup can restore Exchange, OneDrive, and SharePoint data quickly after something goes wrong. It is useful, but it is also recent, and it only covers those Microsoft 365 workloads.
Purview retention policies and litigation hold keep copies of data around so it can be recovered or produced later.

Everything else about recovery is on you. A tested restore process, a disaster recovery runbook, recovery for your endpoints and any on-premises systems, and the plan for who says what while the business is down. None of that comes in a license. If you only remember one line from this post, make it this: the Microsoft stack helps you govern, identify, protect, detect, and respond, and it barely helps you recover. Recover is the job you own.

Where the tools step on each other

Two overlaps are worth calling out so you don’t pay twice for the same work or, worse, assume something is covered when two tools are quietly leaving a gap between them.

Detect and Respond: XDR, Sentinel, and the individual Defenders

This is the big one. Defender XDR, Microsoft Sentinel, and each individual Defender product all detect and can all respond. The simple rule of thumb: Defender XDR is the default engine for Microsoft workloads, Sentinel extends your reach to everything else and to custom and long-term needs, and the individual Defenders feed both. Decide who owns what up front so an alert has one clear home.

Govern: Secure Score and Compliance Manager

Both answer the question how are we doing, from different angles. Secure Score is your quick internal health number and it is great for driving day to day improvement. Compliance Manager is the formal, evidence-backed view mapped to regulations and it is what you take to an audit. Use Secure Score to improve and Compliance Manager to prove.

What order to turn things on

If you are staring at all of this and wondering where to start, here is an order that builds real maturity instead of noise.

Start with Protect. Conditional Access with strong authentication and Intune device compliance give you the most risk reduction for the least effort. Do this first.
Then Detect. Turn on Defender XDR for your Microsoft workloads and connect Sentinel once you need the wider view. Detection you are not watching is not worth much, so grow this at a pace your team can actually monitor.
Then Identify. Get Secure Score to a healthy baseline, switch on vulnerability management, and run EASM so you know your exposure.
Then Respond. Add automation once your detections are stable, so you are automating good signals rather than false alarms.
Formalize Govern as you grow. Bring in Compliance Manager and access reviews when you have enough in place to actually govern.
Build Recover in parallel and test it. Do not wait for an incident to find out your restore process only exists on paper.

Back to the board

The question that started all of this was simple. Where are we strong, and where are the gaps. Owning the tools is the easy half of the answer. Knowing what each one covers, where they overlap, and that Recover is the piece Microsoft leaves for you, is what lets you put the whole thing on one page and actually answer. That one page is the real deliverable, and now you have the map to draw it.