Microsoft Moves the SIEM Into Defender: What ISOC Means for Your SOC
On September 23, 2026, Microsoft opened a public preview of the Integrated Security Operations Center (ISOC) in Microsoft Defender. Strip away the launch language and the change is this: SIEM capabilities that used to require buying Microsoft Sentinel now show up inside the Defender portal for eligible Microsoft 365 E5, E7 and Defender Suite customers, alongside XDR, threat intelligence, automation and AI.
For SOC leaders, that raises practical questions. Is this a new product? What does it cost? Do you have to migrate? And if your SIEM of record is Splunk or another non-Microsoft platform, should you care? This post walks through what was announced, what it actually changes, and how we would approach it.
Why Microsoft is doing this now
Microsoft's argument is about speed. The company says it is now seeing AI-executed operations, where automated tooling runs most of an intrusion and humans only steer. Rob Lefferts, who leads Microsoft Threat Protection, described work that once needed entire teams now needing "a single operator and an agent framework."
Meanwhile, a typical SOC still stitches incidents together by hand across separate tools. Microsoft's answer is what it calls an integrated protection loop: detection, investigation, disruption, containment and remediation running on one shared set of signals, context and controls, usable by both analysts and AI agents.
ISOC is also the foundation for Project Perception, the multi-agent system Microsoft introduced in July. Perception supplies the models and agents. ISOC supplies the data, the context and the response actions those agents depend on. That distinction matters when we get to cost.
What ISOC is, and what it is not
ISOC is not a standalone SKU. It is a licensing benefit attached to Microsoft 365 E5, Microsoft 365 E7 and Microsoft Defender Suite. Security mini suites, standalone security suites, education and frontline SKUs are excluded, and there is no minimum seat count.
During this first preview phase, only eligible tenants without an active Microsoft Sentinel workspace can join. Existing Sentinel customers see no change today and can opt in starting November 15, 2026. Sentinel remains available as a standalone SIEM.
Two layers of capability
The most useful way to think about ISOC is in two layers.
Available with the license alone, no Azure resources required:
- Case management, covering incident cases plus generic cases for work like vulnerability follow-ups or audit requests
- Workbooks for dashboards and reporting
- Natural-language playbook generation, which produces Python playbooks you review and test before activating
- Enhanced automation rules and automation on Microsoft data
Requires an ISOC workspace (an Azure Log Analytics workspace created from the Defender portal):
- User and Entity Behavior Analytics (UEBA)
- Content hub solutions and data connectors (Microsoft cites 500+)
- Threat intelligence experiences
- Repositories for detection content as code
- Ingesting Azure and third-party security data, and automating on it
Creating a workspace also requires an Azure subscription and the right roles. Because it is a Log Analytics workspace, the region is fixed at creation, so settle data residency before you click Connect.
Data, retention and cost
This is where ISOC departs most from a classic Sentinel deployment.
Native Defender telemetry is used where it already lives. It is not re-ingested and re-billed into a workspace. Included retention for Defender data is 30 days during the preview and extends to 90 days on November 15, 2026.
Non-Microsoft data goes into the ISOC workspace on a new pay-as-you-go meter of $2.40 per GB (US rate), available since October 1, 2026. For comparison, the Sentinel analytics tier lists at $4.30 per GB pay-as-you-go in East US, so the ISOC meter is a meaningful discount. It is not automatically the cheapest option, though. Large Sentinel customers on high commitment tiers may already pay less, and the Sentinel data lake tier remains far cheaper for high-volume, low-value logs you keep only for investigations.
One trade-off for existing Sentinel customers: E5 currently includes a data grant of up to 5 MB per user per day for eligible Microsoft data, and opting into ISOC is expected to mean giving it up. For a 5,000-seat tenant that is roughly 25 GB a day, so model both scenarios before November 15.
Key dates
| Date | What happens |
|---|---|
| Sept 23, 2026 | Public preview opens for eligible tenants without Sentinel |
| Oct 1, 2026 | $2.40/GB third-party ingestion meter available |
| Nov 15, 2026 | Included retention moves to 90 days; existing Sentinel customers can opt in |
| Nov 17 to 20, 2026 | Microsoft Ignite, where more migration detail is expected |
| Mar 31, 2027 | Sentinel no longer supported in the Azure portal |
One more point: Project Perception is not part of the ISOC benefit. It is in invitation-only preview with its own consumption pricing. Treat the foundation and the agents as two separate buying decisions.
The SecTower take
If you are a Defender-only E5 or E7 shop
This is close to free value. Turn on case management, workbooks and generated playbooks, none of which need an Azure footprint. Then make a deliberate call on which non-Microsoft sources, if any, justify a workspace. Pick one investigation question (for example, confirming whether a compromised identity also acted in AWS), connect only the source that answers it, put a budget alert on the resource group, and measure a week of volume before expanding.
If you already run Sentinel
Nothing forces your hand. Do not disconnect a production workspace just to try the preview. Use the time before November 15 to compare your effective per-GB rate, including commitment tiers and the E5 grant, against the ISOC terms. Keep moving toward the Defender portal regardless, because the March 2027 Azure portal retirement still applies.
If Splunk or another SIEM is your system of record
For many organizations, especially those standardized on Splunk, the answer is not rip and replace. A connector count is not a migration plan. A few things to think through:
- Decide where correlation lives. If Defender incidents already flow into Splunk Enterprise Security and feed risk-based alerting, running ISOC case management alongside it can create two queues for the same incident. Pick one place where analysts work cases and one place where risk is scored.
- Avoid paying twice. Sending firewall, cloud and identity logs to both Splunk and an ISOC workspace means paying to ingest them twice. Be explicit about which platform owns each source.
- Prove it before you move. If consolidation is on the table, rebuild your highest-value cross-vendor detections in ISOC, run both platforms in parallel on the same data, and compare detection results and investigation quality. Then decide.
- Use the free layer anyway. Even in a Splunk-first SOC, Defender-native case management and automation on Microsoft data can tighten response for endpoint and email incidents without touching your SIEM architecture.
Governing automation and agents
Generated playbooks and AI agents are privileged automation and should be governed that way. Start with enrichment playbooks, not containment. Review generated code before activation. Treat every integration identity as a privileged service principal; playbooks that work with incident cases need tenant-wide Microsoft Graph write permissions, so scope and review them accordingly. Also note that generated playbook runs are recorded in the activity log rather than the Sentinel health table, so update your monitoring.
If you are in a regulated sector
Ninety days of included retention is operational retention, not compliance retention. Without a connected primary workspace, case history stays in Defender for 180 days by default, which may not satisfy your auditors. Plan long-term retention separately, confirm the workspace region with your compliance team, and account for concentration risk: putting identity, endpoint, productivity and security operations with one vendor belongs in your third-party risk assessment. Government and sovereign cloud customers are listed as eligible, but the technical documentation for those environments is still thin, so confirm availability for your cloud before planning around it.
Bottom line
ISOC is less a new product than a repackaging: SIEM workflows folded into Defender for E5 and E7 customers, native data used in place, and a cheaper meter for third-party logs. The agentic vision on top is still early. The foundation underneath, meaning consolidated data, shared context and auditable automation, is worth getting right no matter which platform you standardize on.
If you are working out how ISOC fits next to Splunk, Sentinel or both, SecTower can help you map the cost, coverage and workflow trade-offs before you commit.
ISOC is in public preview. Capabilities, dates and pricing reflect public information as of October 10, 2026 and may change.