What a Co-managed XDR Service Should Deliver

The service should extend your team

A co-managed extended detection and response service should add the capabilities your organization cannot reasonably sustain by itself while leaving business risk decisions accountable to your leadership. Continuous monitoring is one requirement; investigation depth, response authority, detection engineering, and improvement are others. This is a service evaluation framework, not a description of a NexLinks commercial offering.

Detect and investigate

Microsoft Defender XDR coordinates signals across supported security workloads. A provider still needs to demonstrate how analysts move from an alert to a scoped incident. Ask for sample evidence showing the affected entities, timeline, related activity, investigative reasoning, and unresolved questions. A low detection-time number is not meaningful without a definition of its starting point and measurement method.

Supporting reference: What is Microsoft Defender XDR? - Microsoft Defender XDR ↗

Agree on containment authority

Specify who may isolate devices, restrict identities, revoke sessions, or block infrastructure. Include exceptions for critical business and clinical systems, escalation paths, and the evidence required before an action. Exercise these procedures with the people who will receive the call outside normal hours.

Remediate and harden

Closing an incident should lead to a review of persistence, access, configuration, detection coverage, and the conditions that made the attack possible. Track the resulting changes with owners and due dates. A service that repeatedly handles the same preventable incident without improving controls is leaving operational work unfinished.

Keep access and data ownership inspectable

Document where telemetry is stored, who can access it, which delegated permissions the provider uses, and how access is removed when the contract ends. Microsoft Azure Lighthouse supports delegated Azure resource management; it should not be assumed to cover every Microsoft security service or permission path.

Measure what changed

Use regular reviews to examine incident quality, unresolved exposure, detection tuning, service coverage, and relevant platform changes. Ask for evidence that the environment is becoming more supportable and resilient rather than relying on ticket counts or vendor badges.