A unified pre- and post-breach defense suite that coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications. It correlates signals from Defender for Endpoint, Office 365, Identity, Cloud Apps, and other products into unified incidents.
In SC-900 it is managed in the Microsoft Defender portal (security.microsoft.com), together with Sentinel. Its automatic attack disruption contains in-progress attacks, such as ransomware, by disabling accounts or isolating devices.
Microsoft Defender XDR is a concept that can show up on the exam. Check the full guide to see it in context.