IntelligentHQ
IntelligentHQ
Skip to content

Security operations

Detection and response on Microsoft's security stack: Microsoft Defender XDR across endpoints, identity, email and apps, Microsoft Sentinel as cloud-native SIEM moving fully into the Defender portal, and Microsoft Security Copilot, included for Microsoft 365 E5 and E7 customers.

3 technology profiles in this area

In this area

Overview

Microsoft Defender XDR correlates signals from the Defender products you license (Endpoint, Office 365, Identity, Cloud Apps, Vulnerability Management and Defender for Cloud) into combined incidents, and can automatically contain attacks in progress. Microsoft Sentinel is the SIEM for Microsoft and non-Microsoft data, with playbooks built on Azure Logic Apps.

The two are converging. After March 31, 2027, Sentinel will only be available in the Defender portal. An Integrated Security Operations Center (ISOC) experience, in preview, brings SIEM features into Defender for Microsoft 365 E5, E7 and Defender Suite customers without an active Sentinel workspace.

Security Copilot adds generative AI and agents for triage, hunting and reporting. Microsoft 365 E5 and E7 customers receive 400 Security Compute Units per month for every 1,000 paid user licenses, up to 10,000 per month, at no extra cost.

A small organization without a security operations team may find Defender's incidents and automatic attack disruption enough before taking on a SIEM.1234

Problems it addresses

  • Alert overload1

    Defender XDR groups related alerts from several products into a single incident with the affected assets and automated actions.

  • Non-Microsoft log sources2

    Sentinel ingests data through connectors, Syslog, common event format and REST APIs, and normalizes it with ASIM.

  • Portal migration2

    Sentinel in the Azure portal ends after March 31, 2027, and new tenants since July 2025 are onboarded to the Defender portal.

  • Analyst time on routine triage4

    Security Copilot agents help with tasks such as phishing triage, alert classification and access reviews.

  • Unclear AI capacity costs4

    The E5 and E7 inclusion gives a monthly allocation that does not roll over; usage beyond it will later be throttled, with optional pay-as-you-go.

A typical workflow

  1. Turn on Defender XDR1

    Meet the licensing requirements and enable the service in the Microsoft Defender portal.

  2. Bring in wider data3

    Add Sentinel, or an ISOC workspace if you are eligible, for Azure and non-Microsoft security data.

  3. Automate response2

    Build automation rules and Logic Apps playbooks, for example to open a ServiceNow ticket when an incident is raised.

  4. Deploy Security Copilot agents4

    Set up agents in Defender, Entra, Intune or Purview; they are not switched on automatically.

  5. Hunt for threats1

    Query 30 days of raw signals from Endpoint, Office 365, Identity and Cloud Apps with custom queries.

Technologies

  • Suite

    Microsoft Defender XDR

    Microsoft Defender XDR is the extended detection and response layer over Microsoft's Defender services. It joins alerts from endpoints, email, identities and cloud apps into single incidents in the Defender portal, supports hunting across that data and can contain an attack automatically while it is still running.

    • Security
  • Cloud application

    Microsoft Security Copilot

    Microsoft Security Copilot is a generative AI service for security and IT teams. It summarizes incidents, writes KQL and runs agents in its own portal and inside Defender, Entra, Intune, Purview and Sentinel. Usage is measured in Security Compute Units; Microsoft 365 E5 and E7 include a monthly allocation.

    • Security
    • Agents
    • AI
  • Cloud service

    Microsoft Sentinel

    Microsoft Sentinel is Microsoft's cloud-native SIEM with built-in SOAR. It collects security data from Microsoft and other sources across clouds and on-premises, detects threats with analytics rules and hunting, and automates response with Logic Apps playbooks. Its data lake tier keeps data for up to 12 years.

    • Security
    • Data

Use cases

Documented implementations

Next steps

  1. If you still run Sentinel in the Azure portal, schedule the move to the Defender portal before March 31, 2027.

  2. Check whether your tenant is eligible for the Security Copilot inclusion and watch SCU use in the usage dashboard.

  3. List log sources outside Microsoft 365 and estimate ingestion before choosing between Sentinel and ISOC.

Sources

  1. What is Microsoft Defender XDR? (opens in a new tab)Microsoft · Vendor-reported
  2. What is Microsoft Sentinel SIEM? (opens in a new tab)Microsoft · Vendor-reported
  3. Integrated Security Operations Center (ISOC) in Microsoft Defender (opens in a new tab)Microsoft · Vendor-reported
  4. Learn about Security Copilot for Microsoft 365 E5 and E7 customers (opens in a new tab)Microsoft · Vendor-reported

Fill out the form below to request your copy.

Name(Required)