IntelligentHQ
IntelligentHQ
Skip to content

Detect and respond to threats

Combine Microsoft Defender XDR, Microsoft Sentinel and Microsoft Security Copilot so analysts work from correlated incidents, contain attacks automatically and investigate faster, while planning for Sentinel moving to the Defender portal by March 2027.

The problem

Security teams face alerts from endpoints, email, identities, cloud apps and third-party tools, each in its own console. Correlating them by hand is slow, and attackers move between systems faster than a manual triage queue.

Tooling is also in transition: Microsoft is moving Sentinel into the Defender portal, and AI assistance for analysts now comes bundled with some licenses, so teams need to know what they already own before buying more.1

The approach

  • Defender XDR correlates signals from the Microsoft security products you license (Defender for Endpoint, Office 365, Identity, Cloud Apps, Defender for Cloud and others) into incidents. Automatic attack disruption applies containment actions to stop attacks in progress, and advanced hunting covers 30 days of raw signals.
  • Microsoft Sentinel adds SIEM and SOAR: data connectors, analytics and playbooks built on Azure Logic Apps. Sentinel is generally available in the Defender portal even without Defender XDR or E5, and Microsoft says it will no longer be supported in the Azure portal after 31 March 2027.
  • Integrated Security Operations Center (ISOC) is in preview for Defender Suite, Microsoft 365 E5 or E7 customers without an active Sentinel workspace, with 30 days of included Defender data retention during the preview.
  • Security Copilot supports investigation, script analysis and reporting, standalone and inside Defender, Entra, Intune and Purview. Microsoft states that E5 and E7 customers get 400 Security Compute Units per month for every 1,000 paid user licenses, up to 10,000, and that usage beyond the allocation will later be throttled, with optional pay-as-you-go at $6 per SCU (as stated on 26 Oct 2026). Agents are not enabled automatically, and Security Copilot is not designed for GCC, GCC High or DoD.

When a simpler route is enough: an organization that runs mostly Microsoft workloads on E5 can start with Defender XDR alone and add Sentinel when it needs third-party data sources, longer retention or custom SOAR.12345

Conceptual architecture

Detect and respond to threats: conceptual architectureCopilot & businessappsAI models & platformData & analyticsDeveloper toolsSecurity, identity &governanceMicrosoft Defender portal: Single queue for incidents, hunting and responseMicrosoft Defender portalMicrosoft Security Copilot: Helps analysts summarize, investigate and reportMicrosoft Security CopilotEndpoints, identities, email, cloud apps and cloud workloads: Sources of security telemetryEndpoints, identities,email, cloud apps and cloud…Data connectors for non-Microsoft sources: Bring third-party logs into SentinelData connectors fornon-Microsoft sourcesPlaybooks on Azure Logic Apps: Automated response workflowsPlaybooks on Azure LogicAppsMicrosoft Defender XDR: Correlates signals into incidents and disrupts attacksMicrosoft Defender XDRMicrosoft Sentinel: SIEM analytics across connected data sourcesMicrosoft SentinelMicrosoft Entra ID Protection: Identity risk signalsMicrosoft Entra IDProtection
Diagram as a list

  1. Copilot & business apps

    • Microsoft Defender portalSingle queue for incidents, hunting and response

  2. AI models & platform

    • Microsoft Security CopilotHelps analysts summarize, investigate and reportConnects to Microsoft Defender portal

  3. Data & analytics

    • Endpoints, identities, email, cloud apps and cloud workloadsSources of security telemetry
    • Data connectors for non-Microsoft sourcesBring third-party logs into SentinelConnects to Microsoft Sentinel

  4. Developer tools

    • Playbooks on Azure Logic AppsAutomated response workflows

  5. Security, identity & governance

    • Microsoft Defender XDRCorrelates signals into incidents and disrupts attacksConnects to Microsoft Defender portal
    • Microsoft SentinelSIEM analytics across connected data sources
    • Microsoft Entra ID ProtectionIdentity risk signalsConnects to Microsoft Defender XDR
Conceptual: one common way to arrange the parts, not a required design.2

Technologies and their roles

  • Microsoft Defender XDR2

    Extended detection and response

    Correlates licensed Microsoft signals and applies automatic attack disruption.

  • Microsoft Sentinel1

    SIEM and SOAR

    Adds connectors, analytics and Logic Apps playbooks; moving to the Defender portal only after March 2027.

  • Microsoft Security Copilot4

    AI assistance for analysts

    Included for Microsoft 365 E5 and E7 customers within a monthly SCU allocation.

  • Microsoft Entra6

    Identity signals

    ID Protection risk detections feed incidents and Conditional Access.

What you need first2

  • Licenses for the Defender products whose signals you want correlated
  • An agreed list of data sources and retention needs before enabling Sentinel connectors
  • A plan to use the Defender portal for Sentinel before 31 March 2027
  • Roles and permissions for analysts in the Defender portal
  • For Security Copilot: a commercial cloud tenant (not GCC, GCC High or DoD) and someone to configure agents

Risks and how to reduce them

Workflows built around the Azure portal stop working1
Move Sentinel use to the Defender portal before 31 March 2027.
Unexpected ingestion costs3
Review connector volumes; ISOC preview notes that extra ingestion may cost more.
Security Copilot usage exceeds the included allocation4
Track SCU use; Microsoft says overage will be throttled at a future date with notice, or billed pay-as-you-go if chosen.
Preview features treated as production3
ISOC is in preview; keep a supported path for critical detections.

Documented examples

Related

Sources

  1. What is Microsoft Sentinel SIEM? (opens in a new tab)Microsoft · Vendor-reported
  2. What is Microsoft Defender XDR? (opens in a new tab)Microsoft · Vendor-reported
  3. Integrated Security Operations Center (ISOC) in Microsoft Defender (opens in a new tab)Microsoft · Vendor-reported
  4. Learn about Security Copilot for Microsoft 365 E5 and E7 customers (opens in a new tab)Microsoft · Vendor-reported
  5. What is Microsoft Security Copilot? (opens in a new tab)Microsoft · Vendor-reported
  6. What is Microsoft Entra ID Protection? (opens in a new tab)Microsoft · Vendor-reported

Fill out the form below to request your copy.

Name(Required)