Defender XDR and Microsoft Sentinel: When is XDR enough, and when do you need Sentinel?

“We have Defender, so someone is watching the alerts, right?” We hear this question from management teams regularly. The technology detects a lot, but without defined ownership an alert remains an entry in a list. This article first clarifies what monitoring means organisationally, and then when Defender XDR is sufficient and when Microsoft Sentinel comes in.

What does “someone is watching the alerts” actually mean?

It means a named person assesses an alert within an agreed time, makes a decision, acts and documents it. If any of these steps is missing, you carry the risk of an unnoticed attack without knowing it. For management, the key decision is therefore what coverage you need at which times; the product comes second.

Three models are common:

• Internal: Your own staff triage. This gives the best knowledge of the environment, but requires deputies, on-call duty and ongoing training.
• Managed: A service provider monitors and responds according to agreed rules. You get coverage without hiring, but you have to settle authority, escalation and handovers in the contract.
• Hybrid: The provider covers nights, weekends and first-level triage, while internal IT decides on interventions that affect business operations.

An example calculation with assumed values shows why round-the-clock coverage rarely works internally: a year has 8,760 hours. Assume a full-time employee is actually available for around 1,600 hours a year after leave, sickness and training. Then a single permanently staffed seat already requires roughly five to six people. Your own figures may differ; the order of magnitude explains why many companies opt for a hybrid model.

What does Microsoft Defender XDR cover without Sentinel?

Defender XDR (extended detection and response, i.e. detection across several protection products) brings together Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps in the Defender portal. Related alerts are automatically merged into an incident, a single case with the attack timeline and the affected accounts and devices.

Particularly relevant for IT:

• Automatic attack disruption: When Defender has high confidence in an attack in progress, such as ransomware or business email compromise, it disables compromised accounts or contains devices on its own. Every action is traceable and reversible in the Action center. It requires Defender for Endpoint Plan 2.
• Advanced hunting: Queries in KQL (Kusto Query Language) across the raw data of the last 30 days.
• Licensing: Microsoft 365 E5 includes the Defender XDR components. With E3, a security add-on is required.

If your environment consists mainly of Microsoft 365, Entra ID and managed Windows devices, a properly configured Defender XDR with clear triage is often more effective than a SIEM that nobody maintains.

What does Microsoft Sentinel add?

Microsoft Sentinel is a SIEM (security information and event management, the central collection and analysis of logs). It becomes necessary when questions arise that Defender XDR alone cannot answer:

• Additional data sources: Firewalls, network components, Linux servers, line-of-business applications or Azure resources via data connectors.
• Long retention: Data in the analytics tier is retained for 90 days at no extra charge, and the Sentinel data lake is designed for lower-cost retention over years.
• Your own detection rules: Scheduled analytics rules in KQL for your environment, for example for a critical business application.
• Playbooks: Automated workflows based on Azure Logic Apps, for example creating a ticket, notifying the on-call team or disabling an account after approval.
• Multiple tenants: Workspaces across tenant boundaries, which matters for groups of companies and service providers.

What changes with the unified experience in the Defender portal?

Sentinel is generally available in the Defender portal, even without Defender XDR or E5. Incidents from Sentinel and Defender land in one queue, and advanced hunting covers both data sets. Sentinel will no longer be supported in the Azure portal after 31 March 2027 (announcement). July 2026 had originally been announced. If you still run Sentinel in the Azure portal, plan the move now: roles, automation rules and runbooks have to fit the new interface.

What does Sentinel cost if Defender XDR is already in place?

Less than often feared, provided you connect data selectively. The following are free of charge, among others: incidents and alerts from Defender XDR, alerts from the individual Defender products, Azure activity logs and the Office 365 audit logs for SharePoint, Exchange and Teams.

Costs arise with raw data. The advanced hunting tables of the Defender products and the Entra ID sign-in logs are billed by volume. The most important cost decision is therefore: which raw data do you really need for longer than 30 days or for your own rules? Rarely used data belongs in the cheaper data lake tier.

For Microsoft 365 E5 customers there is a separate billing meter, “Microsoft Defender XDR Benefit”. Check the scope and conditions of this allowance on the current Sentinel pricing page before planning; we deliberately do not quote a figure here.

Which operating model goes with it?

In an audit, what counts is whether you can show that incidents are detected and handled. The NIS2 Directive requires, in Articles 21 and 23, measures for incident handling and time-bound notifications. Without logs and documented handling, neither can be evidenced.

Define at least:

1. Ownership per severity: Who triages, and who may disable accounts or isolate devices?
2. Response times: Agreed times for high-severity incidents, including nights and weekends.
3. Runbooks: Written procedures for the most common cases, such as account takeover, malware on a device or suspicious forwarding rules.
4. Evidence: Classification and comments in the incident, a monthly report, a record of every exception.

What the first hour after a suspicion looks like in practice is described in our article Incident response in the Microsoft 365 tenant.

The next step

Whether Defender XDR is fully active in your tenant and whether Sentinel is worth it is something we clarify in the fixed-price Gap Assessment. If you want to hand over monitoring, our Managed Security & SOC takes over triage and response according to agreed runbooks, with monthly evidence for management and audit.

Book an introductory call

Frequently Asked Questions

Does Microsoft Defender XDR replace a SIEM?

For pure Microsoft 365 environments, Defender XDR covers the most important signals and responds automatically. You additionally need a SIEM such as Microsoft Sentinel if data outside Defender is to be analysed, searched for longer than 30 days or monitored with your own rules.

Do we need to act now because of the Azure portal?

If you still use Sentinel in the Azure portal, yes. After 31 March 2027, Sentinel will only be supported in the Defender portal. Plan the onboarding of the workspace, review roles and automation, and train the team in good time.

What belongs in the contract with a managed security provider?

Response times per severity, the provider’s authority (may it disable accounts or isolate devices?), named escalation paths, report format and frequency, and the handover of evidence at the end of the contract.

How much does Microsoft Sentinel cost?

That depends almost entirely on the raw data you connect. Defender incidents, alerts, Azure activity logs and Office 365 audit logs are free; advanced hunting raw data and Entra sign-in logs are billed by volume. A reliable estimate is only possible after reviewing the actual data volumes in your tenant.