Microsoft Sentinel is Microsoft’s cloud-native SIEM (security information and event management) and SOAR (security orchestration, automation and response) platform. It collects security logs from Microsoft 365, Azure, on-premises servers, firewalls and third-party cloud apps into one place, uses analytics rules and machine learning to detect threats across them, groups related alerts into incidents, and runs automated playbooks to respond — for example disabling a compromised account or isolating a device. Because it runs on Azure, there is no SIEM hardware to buy and it scales with your data.
SIEM and SOAR in plain terms
- SIEM answers “what is happening across my environment?” — it centralises logs, correlates events from different systems, and raises alerts.
- SOAR answers “what do we do about it, fast?” — it automates repeatable response steps so analysts spend time on decisions, not clicks.
Sentinel does both, and it integrates tightly with Microsoft Defender XDR so endpoint, identity, email and cloud app alerts flow into the same incident queue. Microsoft has been bringing Sentinel into the unified Microsoft Defender portal, so security teams can work in a single console.
How Microsoft Sentinel works
- Collect — data connectors ingest logs from Entra ID, Microsoft 365, Defender, Azure resources, firewalls, Linux and Windows servers, and SaaS apps into a Log Analytics workspace.
- Detect — built-in and custom analytics rules, written in Kusto Query Language (KQL), look for suspicious patterns. User and entity behaviour analytics (UEBA) flags unusual activity.
- Investigate — related alerts are grouped into incidents with an investigation graph showing users, devices, IP addresses and timelines.
- Respond — automation rules and Logic Apps playbooks enrich, assign, notify or remediate automatically.
- Hunt — analysts run proactive queries to find threats that did not trigger an alert.
Key features
| Feature | What it gives you |
|---|---|
| Content hub and data connectors | Prebuilt connectors, rules, workbooks and playbooks for hundreds of products |
| Analytics rules | Scheduled and near-real-time detections, plus Microsoft threat intelligence matching |
| UEBA | Baselines normal behaviour for users and devices and highlights anomalies |
| Automation and playbooks | No-code and low-code response workflows built on Azure Logic Apps |
| Workbooks | Dashboards for SOC metrics, compliance reporting and data health |
| Hunting and notebooks | KQL hunting queries and Jupyter notebooks for advanced investigations |
How Microsoft Sentinel pricing works
Sentinel is billed mainly on the volume of data you ingest and how long you keep it. You can pay as you go per gigabyte or choose a commitment tier with a daily volume for a lower effective rate. Lower-cost log tiers exist for high-volume, low-value data such as verbose firewall logs, and some Microsoft data sources — for example certain Microsoft 365 audit logs and Azure activity logs — can be ingested at no extra charge. Eligible Microsoft 365 E5 customers have also received data grants for some Microsoft security data. Because pricing and benefits change, estimate costs with the Azure pricing calculator using your real log volumes.
How to keep Sentinel costs predictable
- Start with high-value sources: Entra ID sign-ins, Defender XDR, Microsoft 365 audit and critical firewalls.
- Filter noisy events at collection time instead of ingesting everything.
- Route bulky, rarely queried logs to lower-cost tiers.
- Review ingestion by table every month — a misconfigured server can double your bill overnight. Our cloud monitoring and FinOps service covers this.
Do you need Sentinel if you already have Defender?
Microsoft Defender XDR correlates signals across Microsoft’s own security products. Sentinel extends that to everything else — firewalls, VPNs, Linux servers, non-Microsoft SaaS — and adds long-term retention, custom detections and automation. If your environment is mostly Microsoft 365 and you have little else to monitor, Defender XDR may be enough for now. If you have firewalls, servers, multiple clouds or a compliance requirement for central log retention, Sentinel is the natural next step. Our comparisons of Defender for Business vs Defender for Endpoint and Microsoft 365 E3 vs E5 explain where the Defender pieces fit.
In-house SOC or managed Sentinel?
Sentinel is a platform, not a service — someone has to tune rules, triage incidents at night and on weekends, and keep connectors healthy. Building a 24/7 in-house SOC requires several trained analysts. Many mid-sized organisations in the UAE and the US instead use a managed Sentinel service, keeping ownership of their data and workspace while a partner provides monitoring, tuning and incident response.
Getting started
- Define the threats and compliance requirements you need to cover.
- Create a Log Analytics workspace in your chosen region (Azure UAE North or UAE Central for in-country data).
- Connect Microsoft sources first, then critical third-party systems.
- Enable a focused set of analytics rules and tune false positives.
- Build playbooks for the most common incidents, such as compromised accounts.
- Agree escalation paths and review metrics monthly — part of an overall Zero Trust roadmap.
Managed Microsoft Sentinel from M365 Enterprise Hub
We deploy, tune and operate managed Microsoft Sentinel for organisations in the UAE and the US as part of our security services. Contact us for a Sentinel scoping and cost estimate.
Frequently Asked Questions
What is Microsoft Sentinel used for?
Microsoft Sentinel is used to collect security data from across an organisation, detect threats with analytics and machine learning, investigate incidents, and automate responses. It acts as a cloud-based SIEM and SOAR.
Is Microsoft Sentinel a SIEM or a SOAR?
It is both. Sentinel provides SIEM capabilities for log collection, correlation and detection, and SOAR capabilities through automation rules and Logic Apps playbooks.
How is Microsoft Sentinel priced?
Sentinel is priced mainly on data ingestion and retention, either pay-as-you-go per gigabyte or through commitment tiers. Some Microsoft data sources can be ingested free, and lower-cost tiers are available for high-volume logs.
What is the difference between Microsoft Sentinel and Defender XDR?
Defender XDR correlates alerts across Microsoft security products such as Defender for Endpoint and Defender for Office 365. Sentinel extends detection to any data source, including third-party systems, and adds custom analytics, long-term retention and automation.
Can Microsoft Sentinel store data in the UAE?
Sentinel runs on a Log Analytics workspace, which can be created in Azure regions including UAE North and UAE Central, allowing log data to be stored in the country.
Do I need a SOC team to use Microsoft Sentinel?
Someone must monitor and act on incidents. Organisations without a 24/7 security team commonly use a managed Sentinel service, where a partner handles monitoring, tuning and response.