Microsoft has introduced a significant enhancement for its Microsoft 365 E5 and E7 customers: security information and event management (SIEM) is now integrated within Microsoft Defender at no additional license cost. This capability is part of the new Integrated Security Operations Center (ISOC) feature, which merges SIEM functionalities with Defender’s extended detection and response (XDR), threat intelligence, and automation tools all within a single portal.
According to Rob Lefferts, corporate vice president of Microsoft Threat Protection, traditional security operations can't keep pace when systems are distinctly separated. In his recent blog post, he highlighted how attackers leverage AI to automate their methods, thereby increasing the urgency for defenders to adopt more cohesive systems.
Previously, while E5 and E7 included Defender XDR, SIEM was separately offered through Microsoft Sentinel. With ISOC, users will have access to data logs from Microsoft’s own security products without incurring ingestion charges. However, data from third-party security tools will incur a fee of $2.40 per GB starting October 1, based on a pay-as-you-go model.
The public preview of ISOC began on September 23, and thus far, Microsoft has not provided a timeline for full production readiness. Availability is targeted at organizations with an active Microsoft Defender Suite and Microsoft 365 E5 or E7 licenses that do not currently utilize Microsoft Sentinel. Notably, there is no minimum seat requirement for access.
This new offering is particularly beneficial for organizations utilizing a predominantly Microsoft-based security stack. Yih Khai Wong, a senior research manager at IDC Asia/Pacific, noted that companies with telemetry already housed in Microsoft environments can avoid separate licensing for data ingestion, effectively simplifying security operations.
A Benefit, Not a Standalone Product
Microsoft has clarified that ISOC is not a new standalone product but rather an enhanced offering within Defender. An FAQ accompanying the launch specified that functionalities like case management and natural-language automation, previously gated behind a separate Sentinel purchase, are now included.
The integration covers various data points such as Defender for Endpoint and Office 365 logs, and data retention during the preview stage is set for 30 days, extending to 90 days after November 15.
Cost Considerations Beyond Basic Offerings
Beyond the integrated features, an ISOC workspace—which requires an Azure subscription—is necessary for accessing additional tools such as user and entity behavior analytics (UEBA) and more than 500 data connectors. Wong highlighted that organizations operating in mixed environments will need to perform comprehensive cost analyses, particularly if they rely on non-Microsoft systems.
The current preview excludes any organization that already has an active Sentinel workspace. Existing Sentinel users who meet the licensing criteria can choose to transition to ISOC once the 90-day retention option is available.
For Chief Information Security Officers (CISOs) currently using separate SIEM solutions, the transition will require careful consideration, especially regarding the costs and logistics associated with migration, including potential retraining and contract complexities.
Sanchit Vir Gogia, chief analyst at Greyhound Research, suggested that enterprises try to replicate high-value detection alerts across different vendor platforms before making the switch to ISOC, as Microsoft’s wide range of connectors may not guarantee equal compatibility for all data sources.
Robust Agent Strategy on the Horizon
Lefferts framed ISOC as a vital part of Microsoft's broader agent strategy introduced earlier this year with Project Perception. However, Gogia questioned whether a single-vendor ecosystem is genuinely required, pointing out that while integration has become easier, it doesn’t necessitate exclusivity for effective operations.
While Microsoft hasn’t disclosed specific details regarding logging or auditing of agent actions in ISOC, Gogia raised concerns about the risks involved when agents are granted modification permissions, noting the potential impact on identity and policy changes.
The addition of agents introduces new attack surfaces, as Wong cautioned that adversaries could potentially manipulate the underlying telemetry used by these agents, thereby undermining their effectiveness.
In the end, while Microsoft has streamlined integration for its customers, the ongoing challenge lies in ensuring users retain the capability to audit and manage changes effectively. Microsoft had not responded to inquiries regarding this topic at the time of reporting.
