Skip to content

Detection and response for Microsoft 365

Defender switched on, tuned and tested.

Defender for Endpoint, Office 365, Identity and Cloud Apps, plus Exposure Management and Sentinel, set up as one incident queue. I pilot controls in rings, set who may contain what, and test the response path before you need it.

Plan the Defender rolloutBook a 30-minute call

Do not send credentials, tenant IDs, incident exports, administrative data, or recovery codes through the public contact form. Scoped access is arranged after the Statement of Work is signed, with MFA and a recorded expiry.

The first hour of a Defender incident, step by stepWho may isolate a device or disable an account is written down before Defender starts to act.
  1. 1Open the incidentRead the incident graph in the Defender portal: the assets, the alerts and the story across them.
  2. 2Real or false?Check the alerts against known-good behaviour. A recurring false positive goes to tuning, not to an investigation.
  3. 3Severity + blast radiusStart from the incident severity, then raise it for privileged accounts, sensitive sites or lateral movement.
  4. 4Pick the pathEndpoint: device isolation. Malicious mail: purge and ZAP. Identity: the account takeover runbook.
  5. 5Assign + recordSet the owner and the classification, and open the ticket in the client tooling.
  6. 6Scope with huntingAdvanced hunting where the story is incomplete.
For a high severity incident the default action is: contain user or device, revoke sessions, notify owner. The first triage decision follows the time your own response authority sets for each severity. The runbook states no response time of its own.
For
An IT manager whose Microsoft 365 tenant, Business Premium to E5, holds Defender licences that were never onboarded.
Length
Scoped per tenant after the baseline read.
Who does it
Michal Jatczak, directly. No SOC and no 24/7 cover.
After the call
A written scope and a fixed price before any production change.

You leave with

Filled with your coverage, owners, test results and exceptions. Working files, not claims about an unnamed customer.

Ask to inspect a runbook

  • Deployment baseline

    Coverage, configuration, exceptions and a prioritised backlog, with attack disruption prerequisites checked.

  • Detection tuning ledger

    Every tuning decision and attack disruption exclusion: reason, owner, MITRE mapping, review date.

  • Ten operating runbooks

    Triage, isolation, email purge, identity, hunting, tuning, custom detections, ASR, vulnerabilities, MDR handoff.

  • Detection logic and policy exports

    KQL, rule metadata, policy state and change references, kept in your repository.

  • Validation record

    A test incident: entities, correlation path, actions reviewed, gaps, owners, re-test conditions.

  • Control-to-evidence mapping

    Implementation evidence mapped to the framework objectives you name, for example NIS2, GDPR or DORA.

  • Exit Kit

    Ownership, access removal, contacts, evidence locations, open exceptions, handover checks.

The files, by name
  • defender-deployment-baseline-checklist.md

    Deployment baseline

  • detection-tuning-ledger.md

    Detection tuning ledger

  • RUNBOOK-01 through RUNBOOK-10

    Ten operating runbooks

    1. Incident triage
    2. Device isolation and endpoint response
    3. Email purge and ZAP
    4. Identity compromise
    5. Advanced Hunting with KQL
    6. False-positive tuning
    7. Custom detection rule
    8. ASR and attack-surface change
    9. Vulnerability remediation
    10. MDR or SOC handoff
  • In your repository

    Detection logic and policy exports

  • incident-validation-record.md

    Validation record

  • control-mapping-matrix.md

    Control-to-evidence mapping

  • EXIT-KIT-m365-defender.md

    Exit Kit

What Defender covers, and what I configure

  • Defender for Endpoint

    Onboarding by OS, tamper protection, EDR, standard ASR rules to Block, remediation levels per group.

    I check first: a third-party antivirus keeping Defender passive, which stops ASR rules.

    Needs: Plan 1 for protection and ASR. EDR needs Plan 2 or Defender for Business. Plan map: Defender for Endpoint

  • Defender for Office 365

    Standard or Strict presets, impersonation protection, Safe Links and Attachments including Teams, ZAP, SPF, DKIM, DMARC.

    I check first: whether mailbox intelligence still sits at its default, Don't apply any action.

    Needs: Plan 1 (in E3 from 1 July 2026). Threat Explorer and AIR need Plan 2. Plan map: Defender for Office 365

  • Defender for Identity

    Sensor v3.x on Windows Server 2019 or later domain controllers with the September 2026 or later cumulative update. v2.x for older servers, VPN or syslog.

    I check first: whether hybrid Active Directory exists. Cloud-only identities rely on Entra ID Protection (P2).

    Needs: E5, EMS E5, a Defender Suite or a standalone licence. Not in Business Premium or E3. Plan map: Defender for Identity

  • Defender for Cloud Apps

    Microsoft 365 connector with every box ticked, Cloud Discovery, app governance, Conditional Access app control.

    I check first: that the Microsoft 365 connector and app governance are on, or hunting tables stay empty.

    Needs: E5, EMS E5, a Defender Suite or a standalone licence. App control also needs Entra ID P1. Plan map: Defender for Cloud Apps

  • Vulnerability and Exposure Management

    Vulnerability recommendations, now under Exposure Management, with named owners. Critical assets tagged, attack paths reviewed.

    I check first: that critical assets are defined, or attack paths can come back empty.

    Needs: Full experience with Business Premium, E5 or E3 + Suite. Learn lists E3 alone for Secure Score only. Plan map: Vulnerability and Exposure Management

  • Sentinel in the Defender portal

    Connector ledger, the Defender XDR connector, custom detections or analytics rules, analytics or data lake tier per table.

    I check first: which portal your analysts use. Azure-portal support ends after 31 March 2027.

    Needs: An Azure subscription and workspace. No Defender XDR or E5 needed. Plan map: Sentinel in the Defender portal

  • Attack disruption and Security Copilot

    Attack disruption prerequisites, a short exclusion list. Copilot roles, the data-sharing option you choose, compute-unit owner.

    I check first: who reviews the Action Center, and that no group is on No automated response.

    Needs: Defender for Business or Plan 2 for disruption. Copilot compute units are included with E5 and E7; on other plans they are provisioned and billed. Plan map: Attack disruption and Security Copilot

Five attacks, and who decides what

Defender can act on its own when its prerequisites are in place. Each attack lists the decisions you and I settle first.

AiTM phishing, then email compromiseFirst signal: An AiTM or stolen-cookie alert, or an inbox rule after a risky sign-in.
What Defender can do on its own

Attack disruption can suspend the user and revoke sessions, if the workloads are deployed. ZAP can move the mail to quarantine or to Junk Email.

Business Premium: these alerts use the Cloud Apps connector, which it does not include. The Suite adds Cloud Apps.

What you decide, with me
Disabling an executive account, resetting MFA, removing hidden inbox rules.
Runbook
Identity compromise, Email purge and ZAP, Advanced Hunting with KQL
OAuth consent phishingFirst signal: A user consents to an unknown app. App governance or consent-abuse alerts fire.
What Defender can do on its own

Attack disruption has an OAuth app compromise action, and app governance can disable apps. Both need Cloud Apps fully connected.

Business Premium: Cloud Apps is not included. The Suite adds it.

What you decide, with me
Who revokes the grant, which apps are allow-listed, the consent policy.
Runbook
Incident triage, Identity compromise
QR-code phishing to a personal phoneFirst signal: A message with a QR code. EmailUrlInfo shows UrlLocation QRCode.
What Defender can do on its own

Built-in protection and Defender for Office 365 can extract URLs from QR codes. ZAP can move the message to quarantine or Junk Email after a later verdict.

Business Premium: Plan 1 has real-time detections; Threat Explorer is Plan 2.

What you decide, with me
Which QR-heavy senders are legitimate, whether to require a compliant device.
Runbook
Email purge and ZAP
Ransomware from an unmanaged deviceFirst signal: Password spraying or SMB activity from a device that is not onboarded.
What Defender can do on its own

Attack disruption can contain an unmanaged device or its IP address and the user, and isolate a compromised onboarded workstation. Automatic isolation is in preview and covers workstations only.

Business Premium: attack disruption is built in. Servers need a Servers add-on.

What you decide, with me
Which devices may be isolated, which servers are excluded, when to lift it.
Runbook
Device isolation and endpoint response, ASR and attack-surface change
Password sprayFirst signal: Many failed sign-ins across accounts, then a success.
What Defender can do on its own

Risk-based Conditional Access can force a password change or MFA (Entra ID P2). Attack disruption can step in if it correlates into a compromise.

Business Premium: risk-based policies are Entra ID P2, not P1.

What you decide, with me
Confirming the risk, resetting credentials, blocking legacy authentication.
Runbook
Identity compromise

How it runs and what I need from you

Each surface gets its own evidence and gate. A good email pilot does not approve device isolation.

  1. Observe

    A read-only pass over coverage by OS, Secure Score, mail policies, sensor health, connectors and licences.

  2. Design

    Pilot rings, response authority per device group, remediation levels and attack disruption exclusions, in writing.

  3. Pilot

    ASR rules in audit mode, Standard presets on one mail group, test accounts, a small production cohort.

  4. Enforce

    ASR rules move to Block per rule as audit data supports it. Every change has a named approver and a reversal path.

  5. Validate

    Run a test alert, or a simulated phish with Plan 2, follow it through the Action Center, write the validation record.

  6. Hand over

    Baseline, ledger, runbooks and evidence move to your repository. My access is removed and confirmed.

Client inputs and prerequisites

  • Named security, IT, messaging, identity, and application owners
  • Appropriate Microsoft service prerequisites for the selected surfaces
  • Approved pilot groups, test accounts, maintenance windows, and response authority
  • A retained on-call, SOC, or MDR function where after-hours monitoring is required
  • Secure access approval and a client-owned evidence repository

Incident readiness, in half a day

One attack, played out against your own tenant settings: a taken-over mailbox or a taken-over administrator account. You leave knowing who contains what in the first hour, and how long you have to report it.

  • A decision record: who may disable an account, isolate a device or purge mail, without asking first
  • The first-hour runbook for that attack, built from the Defender runbooks
  • Your reporting clock for a significant incident, if you are an essential or important entity under NIS2: without undue delay, and no later than 24 hours for the NIS2 early warning and 72 hours for the incident notification, counted from when you become aware of it, then the final report within one month of the notification; for a financial entity, the DORA timelines instead. As a controller: notice of a personal data breach to the data protection authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR Art. 33(1))
  • Who receives the report: your CSIRT or, where applicable, your competent authority (NIS2 Art. 23(1)); you confirm which one and I write it into the runbook. In Poland, until the sectoral CSIRT for your sector is announced as operational, the CSIRT MON, CSIRT NASK or CSIRT GOV competent for your entity receives it, unless a sectoral cybersecurity team for your sector was set up before 2025: that team became the sectoral CSIRT and receives the report (amending act Dz. U. 2026 poz. 252, art. 42(2), 44 and 46). For most private companies that is CSIRT NASK today
  • Log retention: Audit Standard keeps audit logs for 180 days. Audit Premium (E5 or Purview Suite) keeps Entra ID, Exchange, OneDrive and SharePoint logs for one year, for users with that licence. Longer, or for other logs: audit log retention policies (an Audit Premium feature) up to one year, up to 10 years with an add-on licence per user, or export to Log Analytics
  • The gaps the tabletop found, each with an owner

Half a day, one scenario, your own tenant settings. It needs no Defender rollout first.

Book the readiness session

Sentinel: every log source has to earn its ingestion cost.

Defender XDR covers the Microsoft signals. When firewalls, SaaS audit logs, custom applications or multi-cloud matter, Sentinel joins the same incident queue. After 31 March 2027 Microsoft supports Sentinel only in the Defender portal, not in the Azure portal. Your MDR or SOC operates the queue: I do not run a SOC or MDR and never take part in handling your alerts.

Two tiers: Build sets it up, Detection as code keeps every rule in a repository

Each tier runs the same way: the connector ledger and threat model first, then deploy and tune against a measured baseline, then a documented hand-off. The monthly cost and rule review after that is the Operate retainer, the same plan as every other service. What each tier covers is written into the Statement of Work, which both parties sign before I get access to your tenant or workspace. Ingestion bills in your subscription, at Azure prices, under your budget.

The weeks, counts and window below are asserted: I say so, and the Statement of Work sets the figures for your engagement.

  • Build

    A tuned baseline that respects the budget it was given.

    Fixed scope, 4-6 weeks

    • Weeks 1-2: connector ledger scored, threat-model workshop, budget set
    • Workspace and top 5 connectors with cost-value justification
    • 50+ analytics rules tuned over a 2-week false-positive baseline
    • Top 3 automation playbooks and daily-cap guardrails armed
    • Runbook library and a 30-day window: questions and tuning fixes on the delivered rules, no response time

    A SIEM your team trusts and your CFO can read, with every source justified in writing.

    Scope the Build tier

  • Detection as code

    Every rule in your repository, deployed through pull requests.

    Fixed scope, after Build

    • Everything in Build
    • Detection-as-code pipeline: repo, PR governance, API deploys
    • Custom threat hunting on emerging actors, with artefacts filed
    • UEBA configuration and insider-threat detections
    • Rule provenance and version history, plus tabletop exercises

    A SIEM whose every rule has provenance, and a hunt programme that leaves evidence.

    Scope the Detection as code tier

Detections you can read before you buy

Excerpt of sample-password-spray-success.kql

MITRE technique T1110.003

// Password spray followed by a successful sign-in from the same IP.
// MITRE: T1110.003 (Brute Force: Password Spraying)
let window = 1h;
let user_threshold = 8;
let sprayers =
    SigninLogs
    | where TimeGenerated > ago(window)
    | where ResultType in ("50126", "50053")
    | where IPAddress !in ((_GetWatchlist("TrustedEgressIPs") | project IPAddress))
    | summarize Failures = count(), TargetedUsers = dcount(UserPrincipalName) by IPAddress
    | where TargetedUsers >= user_threshold;
SigninLogs
| where TimeGenerated > ago(window)
| where ResultType == "0" // success
| join kind=inner sprayers on IPAddress
| project TimeGenerated, UserPrincipalName, IPAddress, Failures, TargetedUsers

One of three sample rules shipped in the kit; the delivered library is 50+ Content Hub rules tuned per estate plus custom KQL for your threat model. This sample joins two queries and is written as a scheduled analytics rule; as a custom detection it would run on a schedule, not as Continuous (NRT), with the rule's lookback replacing the TimeGenerated filter.

No rule pages anyone before validation: simulation, replay of a past incident, or a red-team reference, recorded per rule in the detection catalog. On the Detection as code tier the whole library lives in your repository, deployed through pull requests with a history an auditor can walk.

In the Defender portal, Microsoft names custom detections as the best way to create new rules across Sentinel and Defender XDR, and analytics rules remain available. With Sentinel alone, without Defender services, custom detections are limited or unavailable, so analytics rules remain the option. I choose per source, and the catalog records which kind each rule is.

The other two samples in the kit: an inbox-rule exfiltration detection (T1114.003) and a baseline-aware rare-admin-operation rule (T1078.004). Ask for any of them on the discovery call.

The delivery kit, folder by folder

Bracketed fields get filled during delivery, in your repository.

  • 00-discovery

    1 file

    Estate, sources, threat model, budget: the week-1 intake.

  • 01-architecture-decision-records

    3 files

    Data-source strategy and cost guardrails, decided in writing.

  • 02-connector-ledger

    1 file

    Every source scored: GB/day, lane, cost, and who reads it.

  • 03-detections

    5 files

    Catalog template and three sample KQL rules, inspectable now.

  • 04-runbooks

    11 files

    Onboarding, cost spikes, tuning, hunts, MDR.

  • 05-exit-kit

    1 file

    Everything you own, access enumerated, successor handover.

  • 06-compliance

    1 file

    Controls mapped to the objectives you name (for example NIS2, DORA or GDPR), for your reviewer. Not a certification or a compliance opinion.

  • 07-scope-sheet.md

    1 file

    The working sheet for the chosen tier; only the signed Statement of Work binds.

  • 08-operate-pack

    2 files

    The monthly SIEM review: cost vs value, drift, coverage.

What is not included

  • Separate service or retained provider

    The Statement of Work separates implementation, your decisions and retained response services.

    • 24/7 monitoring, staffed alert response, or a response SLA
    • Live breach command, forensics, crisis communications, and the decision whether to notify a CSIRT or a data protection authority, which stays with your organisation
    • Custom Sentinel connectors and threat intelligence feeds
    • Sentinel for SAP (separate scope)
    • Defender for Cloud CSPM or CWPP across Azure, AWS or GCP
    • Penetration testing, certification, regulator approval, legal assurance

Check it before you scope it

The Defender incident response pack is a free download: seven working templates for triage, isolation, email purge, identity compromise and the monthly review. A working aid, not a result.

Open the incident response pack

The Sentinel detection starter is a free download: three KQL detections plus catalogue, tuning, hunting and review records. Validate each in your own workspace first.

Open the Sentinel detection starter

The register of information holds the legal entity, Microsoft partner identifiers, data location and exit terms.

Open the register of information

Pricing

One tenant or a portfolio

What each track includes

  • Coverage Baseline

    Establish which Defender signals are present, which are trustworthy, and what has to change before enforcement expands.

    • Read-only coverage and configuration assessment
    • Permission and operating-owner map
    • Alert-source and incident-correlation review
    • Prioritised onboarding, policy, and tuning backlog
    • Pilot plan with explicit success and stop conditions

    A decision-ready baseline with gaps, dependencies, owners, and a safe deployment sequence.

  • XDR Deployment

    Onboard the agreed surfaces, stage policy changes, validate the incident path, and hand over a working operating pack.

    • Endpoint, email, identity, and cloud-app workstreams as agreed
    • Pilot cohorts and controlled rollout waves
    • Unified RBAC and response-authority design
    • Attack disruption prerequisites checked, exclusions recorded, custom detections where licensed
    • Validation exercise, evidence pack, ten runbooks, and Exit Kit

    An implemented Defender XDR control surface with tested operations and visible exceptions, which your team runs without me.

  • Tenant Portfolio Rollout

    Use one governed method while preserving local ownership, policy overlays, evidence, and access boundaries.

    • Shared deployment standard with per-tenant overlays
    • Pilot tenant followed by approved rollout waves
    • Tenant-specific GDAP and unified RBAC decisions
    • Coverage and exception ledger per tenant
    • Portfolio reporting, handover, and access-removal evidence

    A repeatable rollout without universal credentials, silent local exceptions, or one tenant's evidence being mixed with another.

Fixed in writing before any work starts, from a 30-minute call. The price depends on the rows below.

Contract days
From €600 a dayExcluding VAT. Minimum two days. Invoiced monthly in arrears. Remote, Central European Time.
Billing basis
By the day, or a fixed scope, set in a Statement of Work.
Currency and VAT
EUR, excluding VAT. Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
Invoiced by
Michal Jatczak, sole trader registered in Malta.
What changes the price
Scoped after tenant count, existing licences, workload shape, access model, current telemetry and operating ownership are understood.
Incident readiness
Half a day, one scenario, your own tenant settings. It needs no Defender rollout first.
After the handover
Operate. Ten hours a month for changes, reviews and questions on what I built or reviewed. Unused hours do not roll over. No response time is promised. No minimum term, 30 days' notice on either side, invoiced monthly in advance.
Service level
No SLA and no on-call duty. Dates are written into the Statement of Work.
Terms
Terms of Service, section 05, Ordering, prices and payment

Book a 30-minute call

Compare the Defender and Entra tiers

The detail, if you want it

Which plan switches on what

Read from Microsoft Learn on 18 October 2026. It maps what each plan switches on. It is not a product or licence catalogue and carries no prices; the baseline confirms what your tenant holds. Defender Suite here is Microsoft Defender Suite, formerly the Microsoft 365 E5 Security add-on.

Endpoint
Business Premium
Defender for Business: protection, ASR, EDR, automated remediation and core vulnerability management. No advanced hunting.
Business Premium + Defender Suite for Business Premium
Defender for Endpoint Plan 2: adds threat hunting, live response and six months of data.
Microsoft 365 E3 (from 1 July 2026)
Defender for Endpoint Plan 1: protection and ASR. No EDR.
E3 + Microsoft Defender Suite
Defender for Endpoint Plan 2.
Microsoft 365 E5
Defender for Endpoint Plan 2.
Email and collaboration
Business Premium
Defender for Office 365 Plan 1: Safe Links, Safe Attachments, anti-phishing, real-time detections. No Threat Explorer, AIR or attack simulation training.
Business Premium + Defender Suite for Business Premium
Plan 2: adds Threat Explorer, automated investigation and response, attack simulation training and hunting.
Microsoft 365 E3 (from 1 July 2026)
Plan 1 effective 1 July 2026, Plan 1 capabilities only. Presence in the tenant: confirmed in the baseline.
E3 + Microsoft Defender Suite
Plan 2.
Microsoft 365 E5
Plan 2.
Identity
Business Premium
Entra ID P1. Learn does not list Defender for Identity in this plan.
Business Premium + Defender Suite for Business Premium
Entra ID P2 (ID Protection) and Defender for Identity.
Microsoft 365 E3 (from 1 July 2026)
Entra ID P1. Learn does not list Defender for Identity in this plan.
E3 + Microsoft Defender Suite
Entra ID P2 (ID Protection) and Defender for Identity.
Microsoft 365 E5
Entra ID P2 (ID Protection) and Defender for Identity.
Cloud apps
Business Premium
Learn does not list Defender for Cloud Apps in this plan.
Business Premium + Defender Suite for Business Premium
Defender for Cloud Apps.
Microsoft 365 E3 (from 1 July 2026)
Learn does not list Defender for Cloud Apps in this plan.
E3 + Microsoft Defender Suite
Defender for Cloud Apps.
Microsoft 365 E5
Defender for Cloud Apps.
Automatic attack disruption
Business Premium
Built into Defender for Business for onboarded devices.
Business Premium + Defender Suite for Business Premium
Needs Defender for Endpoint Plan 2, which the Suite adds. Mixed licensing: see the note below.
Microsoft 365 E3 (from 1 July 2026)
Plan 1 has no attack disruption.
E3 + Microsoft Defender Suite
Needs Defender for Endpoint Plan 2, which the Suite adds.
Microsoft 365 E5
Needs Defender for Endpoint Plan 2, which E5 includes.
Advanced hunting and custom detections
Business Premium
Not in Defender for Business.
Business Premium + Defender Suite for Business Premium
With the Plan 2 products.
Microsoft 365 E3 (from 1 July 2026)
Not in Plan 1.
E3 + Microsoft Defender Suite
With the Plan 2 products.
Microsoft 365 E5
With the Plan 2 products.
Exposure Management
Business Premium
Full experience.
Business Premium + Defender Suite for Business Premium
Full experience.
Microsoft 365 E3 (from 1 July 2026)
Secure Score only on Learn's list. Whether Defender for Endpoint Plan 1 widens it: confirmed in the baseline.
E3 + Microsoft Defender Suite
Full experience.
Microsoft 365 E5
Full experience.
Security Copilot
Business Premium
No included units (E5 and E7 only). Compute units are provisioned and billed.
Business Premium + Defender Suite for Business Premium
No included units (E5 and E7 only). Compute units are provisioned and billed.
Microsoft 365 E3 (from 1 July 2026)
No included units (E5 and E7 only). Compute units are provisioned and billed.
E3 + Microsoft Defender Suite
No included units (E5 and E7 only). Compute units are provisioned and billed.
Microsoft 365 E5
Included: 400 compute units a month per 1,000 licences, up to 10,000. Rollout is phased and agents need setup.
  • Business Premium and Defender for Business are for up to 300 users. Defender for Business does not support mixed licensing: with Plan 2 on only some users, the tenant keeps the Business experience until every user is licensed and Microsoft support switches it.
  • Servers are a separate licence line. Defender for Business Servers is capped at 60 licences per customer; beyond that Microsoft points to Defender for Servers.
  • Sentinel in the Defender portal is available with or without Defender XDR or an E5 licence. Microsoft 365 E7 includes everything in E5.
  • Attack disruption also needs the products deployed, standard device discovery, audit settings and a complete Cloud Apps connector. I confirm those per tenant in the baseline.
  • Microsoft changed Microsoft 365 packaging on 1 July 2026. Re-read the plan pages before relying on this map.

Check an add-on against your plan with the free licence overlap tool

Access and authority

Defender actions can affect devices, mailboxes, identities, and SaaS sessions. Assessment access, operating roles, partner access, and production authority are treated as separate decisions.

  • Assessment access

    Security Reader and other read roles come first. Access is arranged after the Statement of Work is signed, with MFA and a recorded expiry.

  • Least privilege, one tenant at a time

    Microsoft Defender unified RBAC and workload-specific roles are mapped to the task, then reduced or removed at handover. Global Administrator is not the operating role.

  • Partner access and portfolios

    Where GDAP fits, access is tenant-specific, granular, time-bound, and explicitly approved. Each tenant keeps its own access decision, evidence, exceptions, and change log, with no universal credential or shared policy plane.

  • Change authority

    Device isolation, mail purge, account action, automation levels, and enforcement changes follow the client's written approval model.

Primary sources

Microsoft documents phased deployment, product-specific pilots, unified RBAC, incident investigation, Action Center review, attack disruption prerequisites and least-privilege GDAP. The page links those sources directly. Plan and date facts were read on 18 October 2026.

Is Microsoft 365 Defender now called Microsoft Defender XDR?

Yes. Microsoft Defender XDR is the current product name for the cross-product detection and response layer.

Is this a licensing offer?

No. This page describes implementation and operating readiness. The plan map in this section shows what each Microsoft plan switches on, read from Microsoft Learn on 18 October 2026, so the scope does not promise controls the tenant cannot run. Procurement is handled separately and does not determine the technical recommendation.

We have Business Premium. Which Defender do we have?

Microsoft 365 Business Premium includes Defender for Business, Defender for Office 365 Plan 1 and Entra ID P1, for up to 300 users. Defender for Business covers protection, ASR, EDR, automated remediation and attack disruption on onboarded devices. It has no advanced hunting, and Defender for Identity, Defender for Cloud Apps and the Entra ID Protection risk policies are not part of it. Defender Suite for Business Premium adds Entra ID P2, Defender for Identity, Defender for Endpoint Plan 2, Defender for Office 365 Plan 2 and Defender for Cloud Apps. The plan map in this section lists the rest.

Do all tenants need every Defender component?

No. The scope follows the actual estate and the protection outcome. Defender for Identity matters most where hybrid Active Directory exists, and it also raises Okta alerts in Defender XDR. Defender for Cloud Apps depends on the SaaS control requirement. The baseline identifies which surfaces add value and which prerequisites are missing.

Do you change production during discovery?

No. Discovery starts with read-only coverage, configuration, permission, and alert review. Production change begins after the target state, pilot cohort, approval path, evidence requirement, and reversal approach are agreed.

How do you stop tuning from hiding real attacks?

Tuning is recorded as an engineering decision. Every material scope, threshold, suppression, or replacement carries a reason, owner, compensating control, and review date. Coverage and validation are checked again after the change.

Does automated investigation act without approval?

It depends on the surface. On endpoints, Microsoft ended the separate automated investigation experience on 1 September 2026: detection and response now run inside the antivirus stack, and what still needs a decision is which device groups attack disruption may contain. Semi automation still allows disruption without approval, and No automated response excludes the group. For email, automated investigation and response stays a Defender for Office 365 Plan 2 feature, and its pending actions wait for an approver we name with you. We record both decisions before broader automation is enabled.

Can attack disruption lock out an executive?

It can contain a user or disable an account when Defender judges an attack to be in progress. Microsoft states a detector precision of 99% or higher for containment actions, so a wrong containment is possible, and every action can be undone from the Action Center. Contain user blocks network logons, SMB, RPC and RDP on onboarded devices, does not disable the account in the identity provider, and is released automatically within five days. Microsoft documents exclusions for users, devices and IPs and does not recommend excluding assets. Before the first incident we record who may be excluded, who reviews the Action Center and who can undo an action.

Is Security Copilot included?

With Microsoft 365 E5 and E7, yes: 400 Security Compute Units a month per 1,000 paid licences, up to 10,000, scaling below 1,000 licences (a tenant with 400 licences gets 160). Allocations reset monthly with no rollover, and Microsoft is rolling the inclusion out in phases from 18 November 2025. The inclusion covers E5 and E7 only; elsewhere compute units are provisioned and billed. Agents are not switched on automatically. We can set the roles and who owns consumption, apply the data-sharing option you choose, and record them. We do not promise time saved.

Can you deploy across multiple tenants?

Yes. A portfolio rollout uses a shared standard with per-tenant overlays, pilot tenants, local owners, separate evidence, and tenant-specific access. GDAP can provide granular and time-bound partner access where it fits. Universal cross-tenant credentials are not used.

Who watches the queue at night?

Your internal team, a retained MDR or SOC provider, or Microsoft's own Defender Experts MDR (formerly Defender Experts for XDR), which is sold separately from the Defender products. I implement, tune and hand over the runbooks; I do not run a SOC or MDR and never take part in handling your alerts. Plan 1 of the Microsoft service covers Defender workloads. Plan 2 adds selected third-party sources through Sentinel and needs at least 1,500 licensed seats. Coverage needs at least one of Defender for Endpoint Plan 2, Defender for Office 365 Plan 2, Defender for Identity, Defender for Cloud Apps or Entra ID P2, deployed in active mode. RUNBOOK-10 prepares the handoff, including the check that each covered product runs in active mode and a record of the response actions Microsoft's experts may take on your behalf.

Where does Microsoft keep our Defender data?

Defender XDR selects a data centre location itself and uses the one Defender for Endpoint uses if you have it. Microsoft lists the EU (North Europe and West Europe) among the regions and shows your location in the Defender portal settings. It says a Defender tenant cannot be moved to a different region once it is created. Microsoft's EU Data Boundary documentation lists several Defender services as excluded: it says most Defender for Office 365 data is transferred and stored in the United States, and that Defender for Endpoint relies on researchers working with data globally. We record your location in the baseline. This describes Microsoft's documented behaviour; we make no residency guarantee of our own. Microsoft's transfers of this data outside the EEA are governed by your own agreement with Microsoft (the Microsoft Products and Services Data Protection Addendum), to which we are not a party.

When do we have to move Sentinel into the Defender portal?

After 31 March 2027 Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal. Microsoft first set July 2026 and later moved the date. Sentinel is generally available in the Defender portal with or without Defender XDR or an E5 licence, and since July 2025 a new customer's first workspace, onboarded by an Owner or User Access Administrator, goes there automatically. What changes for analysts is the unified incident queue, table and retention management in the Defender portal, and custom detections as Microsoft's recommended rule type for new rules.

Defender XDR or Microsoft Sentinel?

For a Microsoft 365 estate, Defender first: it connects prevention, detection, investigation, and response across supported Microsoft security surfaces, and its incidents and alerts reach Sentinel at no ingestion charge. Raw Defender hunting tables stay free for 30 days in the Defender portal and cost money only if you extend or copy them. Sentinel earns its keep when sources beyond Microsoft 365 matter, such as firewalls, SaaS audit logs, custom applications, or multi-cloud. Both sit on this page and are designed to meet in one incident queue; the Sentinel section above carries its own scope and tiers.

Can the evidence support NIS2, GDPR or DORA work?

It can support control-to-evidence mapping for agreed objectives. The pack can link policies, incidents, actions, queries, owners, and exceptions to the selected framework. It is implementation evidence, not legal advice, certification, regulator approval, or an assurance attestation.

How do we operate without me?

The Exit Kit exists from the start. It records the rule and policy repositories, runbooks, access model, operating contacts, evidence locations, open exceptions, and confirmation that my access was removed.

How do you control Sentinel ingestion costs?

Per-connector cost-value scoring, data lake tier routing for low-fidelity sources, daily-cap alerts, and a documented budget guardrail. We do not ingest data we cannot justify against a specific detection.

Our Sentinel bill already exploded. Can you fix it without a rebuild?

Yes. The ledger discipline applies to an existing workspace: measure per-table volume from the Usage table, score every source against the rules that actually read it, keep high-fidelity sources in the analytics tier, send bulky secondary sources such as firewall, proxy and NetFlow logs to the data lake tier, filter noise at ingest, and arm the guardrails. Savings are measured against your own last three invoices, never estimated.

Do we lose detections when logs move to the data lake tier?

The trade is real and it is made explicitly, never silently. Data that sits only in the data lake tier does not feed real-time analytics rules; it is reached through KQL jobs, summary rules and hunting. Where a detection needs a lake-only source, we promote the part it needs through a summary rule or a KQL job into the analytics tier, or accept the gap in writing. The detection catalog records which MITRE techniques rely on which tier, so the coverage decision is a signed document instead of a surprise during an incident. Workspaces not yet onboarded to the data lake still use the word Archive for long-term retention.

Sentinel or a third-party SIEM such as Splunk, Elastic or Chronicle?

Sentinel wins for Microsoft-heavy estates, through licence advantages and native Defender ingestion. Splunk wins for very high-volume bespoke ingestion. Chronicle wins for Google-heavy estates. The choice follows data gravity, not vendor brochures.

Related pages

Put one incident through the operating model before the real one arrives.

Start with a synthetic phishing, endpoint, hybrid identity or OAuth scenario. I map the signals, set who may respond, pilot the controls, test the runbook and file the evidence.

Plan the Defender rolloutPlan a tenant portfolio

The Exit Kit is delivered within 24 hours of an engagement closing under a Statement of Work.

CommittedTerms of Service, section 07, Exit Kit

Clause effective 28 October 2026