Skip to content
Compare Microsoft technologies
Pick up to four. The comparison starts by saying whether they compete, work together or sit in different layers, then lines up their verified facts. It never names a universal winner.
How they relate
Microsoft Defender XDR and Microsoft Sentinel work together.
From the published profiles: one can integrate the other.
Side by side
| Fact | Microsoft Defender XDR | Microsoft Sentinel |
|---|---|---|
| Type | Suite | Cloud service |
| Layers | Security, identity & governance | Security, identity & governance, Data & analytics |
| What it is | Microsoft Defender XDR is the extended detection and response layer over Microsoft's Defender services. It joins alerts from endpoints, email, identities and cloud apps into single incidents in the Defender portal, supports hunting across that data and can contain an attack automatically while it is still running. | Microsoft Sentinel is Microsoft's cloud-native SIEM with built-in SOAR. It collects security data from Microsoft and other sources across clouds and on-premises, detects threats with analytics rules and hunting, and automates response with Logic Apps playbooks. Its data lake tier keeps data for up to 12 years. |
| Who needs it | Organizations that already license several Microsoft security services, for example through Microsoft 365 E5 or Microsoft 365 E3 with the Defender Suite add-on, and want one place to triage and respond. Security operations teams that are short of analysts gain most from correlated incidents and automatic containment. Smaller firms reach the same portal through Microsoft 365 Business Premium or Microsoft Defender for Business. | Security operations teams that must collect and correlate logs from many sources, such as firewalls, other clouds, identity providers like Okta and on-premises systems, and keep them for investigations or regulation. It suits organizations that want a hosted SIEM billed on Azure consumption instead of running their own SIEM infrastructure, and service providers that manage several customer tenants through Azure Lighthouse. |
| What it is not | Defender XDR is not a SIEM: it correlates signals from the Microsoft security products you license, while Microsoft Sentinel collects and analyzes logs from Microsoft and non-Microsoft sources. It is not a single antivirus product either; Defender for Endpoint is one of several components. Automatic attack disruption does not replace incident response: Microsoft positions it as a way to contain an attack and leave the security team in control of investigation and recovery, and it requires Defender for Endpoint Plan 2. | Sentinel is not an endpoint or email protection product; it analyzes data that other tools produce. It is not free with Microsoft 365 E5: ingestion and analysis are billed on Azure, although some data, such as Azure Activity logs, Office 365 audit logs and alerts from Defender products, is free. The product is not being retired: only the Azure portal experience ends after 31 March 2027, when Sentinel will be available only in the Microsoft Defender portal. |
| Prerequisites |
|
|
| Runs on | Microsoft cloud service managed in the Microsoft Defender portal, Devices onboarded to Defender for Endpoint, On-premises Active Directory through Defender for Identity sensors, Cloud workloads through Defender for Cloud, SaaS apps through Defender for Cloud Apps | Azure cloud service on Log Analytics workspaces, Microsoft Defender portal (Azure portal until 31 March 2027), Multicloud and on-premises sources through connectors, Multi-tenant management with Azure Lighthouse |
| Availability and licensing | Checked 26 Oct 2026: Microsoft lists Microsoft Defender Suite at $12.00 per user per month on an annual subscription, with Microsoft 365 E3 (or Office 365 E3 with EMS E3) as a prerequisite. Defender XDR features also come at no extra cost with Microsoft 365 E5 or A5, EMS E5, Microsoft 365 Business Premium, Defender for Business and standalone Defender services. ISOC is in preview. Defender for Office 365 integration is not available in the Norway, South Africa, UAE, Sweden and Singapore data center locations. | Checked 26 Oct 2026: billed on an Azure subscription, pay-as-you-go or with commitment tiers that start at 100 GB per day; data lake ingestion, processing, storage, queries and notebook compute have separate meters. A 31-day free trial covers the first 10 GB per day. Analytics tier retention is included for 90 days. The Learn pages give no per-GB prices; Microsoft points to its pricing page and cost estimator. Sentinel is supported in the Azure portal until 31 March 2027 and afterwards only in the Defender portal. |
| When something simpler is enough | A small business with a handful of devices may get enough from Defender for Business or the protection in Microsoft 365 Business Premium, without building a security operations practice. If most of your security tools come from other vendors, Defender XDR adds less, because it only correlates the Microsoft products you license; a SIEM such as Microsoft Sentinel, which ingests many sources, or an XDR from your main vendor may fit better. | If almost all of your security signals come from Microsoft Defender products, Defender XDR hunting and, for eligible Defender Suite, Microsoft 365 E5 or E7 customers, the ISOC preview in the Defender portal may cover your needs without a separate Sentinel workspace. In our view, small teams without staff to tune analytics rules and watch ingestion costs may also be better served by a managed detection and response service. |
| Last reviewed | 26 Oct 2026 | 26 Oct 2026 |
| Official resources | Product page (opens in a new tab)Documentation (opens in a new tab) | Product page (opens in a new tab)Documentation (opens in a new tab) |
Each value comes from the technology's profile, where every statement links to its source. Pricing, benchmark and compatibility claims are not shown unless a profile documents them.
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.