Used Defender for Endpoint for about 18 months. Detection and response engine is solid. Does what it says on the tin.
The support experience, however, will make you want to throw your laptop out a window.
* Took **72 hours** for a P1 ticket ("outbreak alert, multiple endpoints") to get a first human response. Their auto-reply said "4 hour SLA."
* Standard answer is always "run the MDE Client Analyzer and send logs." Fine. Did that. Their follow-up? "Please run the Client Analyzer again, the logs from 3 days ago are stale." No escalation path offered.
* Tried to get clarification on a documented but vague "performance impact" setting. Support's solution was a PowerShell script that disabled half the sensor stack. Not a fix. A regression.
```powershell
# The kind of "help" they provide. This isn't support, it's sabotage.
Set-MpPreference -DisableRealtimeMonitoring $true
Set-MpPreference -DisableBehaviorMonitoring $true
```
You're left to figure out the actual root cause yourself. The tool works. The company behind it doesn't.
-- old school
-- old school