Microsoft Sentinel
Microsoft Sentinel is a cloud SIEM whose automation rules and Logic Apps playbooks take incidents from the same product, including those ingested from Microsoft Defender XDR. It places ninth of 14 at 5.14, with 9 of 25 containment actions documented. Prices are public, but the automation docs describe no approval gate, rollback or time-to-contain figure.
What Microsoft Sentinel is
Sentinel is a cloud SIEM built on Azure Monitor Log Analytics workspaces. It runs analytics rules, KQL hunting, and automation rules that can call Azure Logic Apps playbooks, plus a data lake tier for long-term data (microsoft.com/en-us/security/pricing/microsoft-sentinel, read 2026-11-03).
Automation rules trigger on incident created, incident updated or alert created. Playbooks are Logic Apps workflows, charged on top of Sentinel (learn.microsoft.com, read 2026-11-03). After 2027-03-31 the product is supported only in the Microsoft Defender portal.
Microsoft Sentinel is a cloud SIEM built on Azure Monitor Log Analytics workspaces. It runs analytics rules, KQL hunting, automation rules that can call Azure Logic Apps playbooks, and a data lake tier for long-term security data. microsoft.com, read
Products named: Microsoft Sentinel (analytics tier), Microsoft Sentinel data lake, Microsoft Sentinel graph, Automation rules, Playbooks (Azure Logic Apps), Azure-Sentinel GitHub content repository.
Ownership. Microsoft Sentinel is a Microsoft product. Azure portal support ends after 2027-03-31; from then it runs only in the Microsoft Defender portal. vendor claim learn.microsoft.com, read
no figureon the pages read
Published time to contain
| Figure | Metric | Sample and who measured | Grade | Source |
|---|---|---|---|---|
| Reduces mean time to respond by about 30 percent | time to respond or remediate | not stated on page. Measured by vendor. Date: not stated. | C | vendor claim microsoft.com, read |
None of these is a time to contain, so the home table shows an open bar. Grades run A (independent, method published) to D (unverifiable). The evidence register explains each grade.
9 of 254 of 5 domains
Containment coverage
Of 25 containment actions across EDR, identity, email, cloud and network, Microsoft Sentinel documents 9 as native or partner on the pages read: 9 native, 0 partner, 0 custom step only, 16 not documented. Coverage share is 36 percent.
- native, vendor-documented
- partner or third-party documented
- custom step only
- not documented on the pages read
| Platform | EDR | Identity | Cloud | Network | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Isolate host | Release isolation | Kill process | Quarantine file | Run script or live response | Block hash | Disable user | Force password reset | Revoke sessions or tokens | Require MFA re-enrolment | Remove from group or role | Delete a delivered message | Quarantine a delivered message | Block sender or domain | Remove a URL rewrite exemption | Pull from quarantine | Disable IAM user or access key | Revoke cloud session | Isolate or stop an instance | Change a security group or firewall rule | Revoke OAuth app consent | Block IP or domain at the firewall | Block at the proxy or DNS filter | Disable a switch port or NAC quarantine | Add to a threat list on the NDR | |
| Microsoft Sentinel9 of 25 documented | Microsoft Sentinel: Kill process, not documented | Microsoft Sentinel: Quarantine file, not documented | Microsoft Sentinel: Block hash, not documented | Microsoft Sentinel: Force password reset, not documented | Microsoft Sentinel: Require MFA re-enrolment, not documented | Microsoft Sentinel: Quarantine a delivered message, not documented | Microsoft Sentinel: Block sender or domain, not documented | Microsoft Sentinel: Remove a URL rewrite exemption, not documented | Microsoft Sentinel: Pull from quarantine, not documented | Microsoft Sentinel: Disable IAM user or access key, not documented | Microsoft Sentinel: Revoke cloud session, not documented | Microsoft Sentinel: Revoke OAuth app consent, not documented | Microsoft Sentinel: Block IP or domain at the firewall, not documented | Microsoft Sentinel: Block at the proxy or DNS filter, not documented | Microsoft Sentinel: Disable a switch port or NAC quarantine, not documented | Microsoft Sentinel: Add to a threat list on the NDR, not documented | |||||||||
Basis: Microsoft Learn pages for the Azure Logic Apps connectors that Sentinel playbooks use, and playbook templates from the Azure-Sentinel repository. The repository directory listing could not be fetched, so only templates reached by direct path were read. Defender XDR automatic attack disruption (contain device, contain user) is documented but is a Defender feature, not a Sentinel playbook action. Read 2026-11-04.
Limits: Sentinel template catalogue not fully enumerable from this environment; coverage is likely understated.
The full grid, with the page behind each cell, is on the scorecard. A cell reads not documented when the pages read did not show the action. That is a finding about public material, not a claim that the action is absent.
5.14rank 9 of 14
Rubric scores
Microsoft Sentinel is in a band with Dropzone AI (5.00), Prophet Security (4.87), Mate Security (4.87). A band is a run of neighbouring totals. Bands chain: a new band starts only where the gap to the total above exceeds 0.25, so a band can be wider than 0.25 and the order inside it is not an order.
| Criterion | Weight | Score | Points | Status, reason and source |
|---|---|---|---|---|
| Native containment coverage | 25 | 4.7 | 1.175 | partial. 9 of 25 containment actions documented as native or partner (36 percent) across 4 of 5 domains. Score is 2.0 plus 7.5 times the share, capped at 9.5. |
| Published time-to-contain evidence with method | 15 | 3.5 | 0.525 | not documented. The automation docs publish no time-to-contain figure. learn.microsoft.com, read |
| Approval, rollback and blast-radius controls documented | 15 | 5.5 | 0.825 | partial. Docs describe a service account with explicit resource-group permissions (Owner needed to grant), rule order and expiry dates, but no approval gate or rollback for actions inside playbooks. learn.microsoft.com, read |
| Explanation and audit trail | 15 | 6.0 | 0.900 | partial. Docs let a rule condition on who updated an incident (user, playbook, automation rule, AIR) which gives change attribution; per-action execution records are not described on this page. learn.microsoft.com, read |
| Integration depth documented | 10 | 6.5 | 0.650 | partial. Playbooks run on Azure Logic Apps and rules react to Microsoft Defender alert sources; no action count on this page. learn.microsoft.com, read |
| Detection-to-response coupling | 8 | 8.0 | 0.640 | documented. Triggers are incident created, incident updated and alert created inside the product, including incidents ingested from Defender XDR, so no separate SIEM is needed. learn.microsoft.com, read |
| Pricing transparency | 6 | 3.5 | 0.210 | not documented. No pricing was read for this record. learn.microsoft.com, read |
| Deployment and data handling | 6 | 3.5 | 0.210 | not documented. Data handling was not on the page read; the page notes Sentinel leaves the Azure portal after 2027-03-31 and runs only in the Defender portal. learn.microsoft.com, read |
| Total | 100 | 5.14 | Sum of the eight weighted points above, to two decimals. | |
Scores are proposals under the rubric bands, computed in code from the published weights. Where a score rests on a vendor's marketing page only, a read of its documentation can move it.
Where Microsoft Sentinel is strong
- Triggers are incident created, incident updated and alert created inside the product, including incidents ingested from Microsoft Defender XDR, so no separate SIEM is needed in front. learn.microsoft.com, read
- Running a playbook from a rule needs the Microsoft Sentinel Automation Contributor role on the playbook's resource group, and a service account needs explicit resource-group permissions. That is a scope control, though not an approval gate. learn.microsoft.com, read
- Prices are published with units and a region note: pay-as-you-go and commitment tiers for the analytics tier, and per-GB meters for the data lake. Playbooks add Logic Apps charges that the page lists separately. microsoft.com, read
Where Microsoft Sentinel is behind
- Time-to-contain evidence: none for automation rules. The automation documentation publishes no figure. The Sentinel product page claims Security Copilot reduces mean time to respond by about 30 percent, with no sample stated and the linked research page not read here (read 2026-11-04, vendor claim). learn.microsoft.com, read
- The docs describe rule order, expiry dates and service-account permissions, but no approval gate and no rollback for actions inside playbooks. A buyer must build both in Logic Apps. learn.microsoft.com, read
- Azure portal support ends after 2027-03-31, when Sentinel runs only in the Defender portal. Teams that own automation in the Azure portal should plan that move. learn.microsoft.com, read
What only Microsoft Sentinel has
Sentinel automation rules can be exported as ARM JSON for CI/CD, and a rule can test whether a user, a playbook, an automation rule or automated investigation last updated an incident. learn.microsoft.com, read
12prices listed
Pricing as published
vendor claim Analytics tier: pay-as-you-go per GB analysed, or commitment tiers that reserve daily ingestion (100 GB to 50,000 GB per day). Data lake tier: per GB ingested, processed, queried and stored, with separate compute meters. Playbooks add Azure Logic Apps charges. Prices are USD estimates on the pricing page, region selector present, values shown at the page's default region. microsoft.com, read
| Item | Price | Source |
|---|---|---|
| Analytics tier, pay-as-you-go | 4.30 USD per GB analysed | microsoft.com, read |
| Analytics commitment tier, 100 GB per day | 296 USD per day | microsoft.com, read |
| Analytics commitment tier, 500 GB per day | 1265 USD per day | microsoft.com, read |
| Analytics commitment tier, 1000 GB per day | 2480 USD per day | microsoft.com, read |
| Analytics commitment tier, 10000 GB per day | 22240 USD per day | microsoft.com, read |
| Analytics commitment tier, 50000 GB per day | 102600 USD per day | microsoft.com, read |
| 50 GB commitment tier (public preview promotion, 2025-10-01 to 2026-12-31) | 161.25 USD per day | microsoft.com, read |
| Data lake ingestion | 0.05 USD per GB processed | microsoft.com, read |
| Data lake processing | 0.10 USD per GB processed | microsoft.com, read |
| Data lake query | 0.005 USD per GB analysed | microsoft.com, read |
| Data lake storage | 0.026 USD per GB per month | microsoft.com, read |
| Graph compute | 3 USD per compute hour | microsoft.com, read |
Trial or free tier. Pricing page advertises up to 5 MB of free daily ingestion per user for key security logs under a Microsoft 365 offer. No general trial terms read. microsoft.com, read
Integrations. No count published; named: Microsoft Entra ID Protection, Microsoft Defender for Cloud, Microsoft Defender for Cloud Apps, Microsoft Defender for Office 365, Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for IoT, ServiceNow (playbook example), Microsoft Teams and Slack (playbook example). vendor claim learn.microsoft.com, read
1graded
Claims Microsoft Sentinel makes about itself
Each is a vendor claim, graded A to D on the method published: A independent with method, B vendor-measured with sample and method, C a number with no method, D unverifiable. This site's own voice does not repeat any of them as fact.
| Claim | Method stated | Grade | Source |
|---|---|---|---|
| Commitment tiers save up to 52 percent over pay-as-you-go rates | not stated. Measured by vendor. | C | vendor claim microsoft.com, read |
Who should shortlist Microsoft Sentinel
- Your estate is Microsoft and you want detection, incidents and response in one product with public prices.
- You have Logic Apps skills and will build approval and rollback yourself.
- You need to ask the docs, not a salesperson, what a rule can and cannot do.
Microsoft Sentinel places 9th of 14 at a total of 5.14, with 9 of 25 containment actions documented. The natural choice for a Microsoft estate that already ingests Defender incidents, with public prices. The scorecard counts 9 of 25 actions from the pages read, and a Microsoft estate may reach more through Logic Apps connectors than those pages show. It shares a band with Dropzone AI, Prophet Security and Mate Security.
The same platform under other weights
- Regulated financial: 11th of 14, total 5.23.
- Lean team: 9th of 14, total 5.05.
- MSSP: 9th of 14, total 5.03.
- Microsoft estate: 9th of 14, total 5.31.
- CrowdStrike estate: 9th of 14, total 5.30.
Compare Microsoft Sentinel
- Microsoft Sentinel alternatives: 3 gaps and 5 platforms that answer them.
- Microsoft Sentinel against Dropzone AI, totals 5.14 and 5.00.
- Microsoft Sentinel against Prophet Security, totals 5.14 and 4.87.
- Microsoft Sentinel against Mate Security, totals 5.14 and 4.87.
- Microsoft Sentinel against Tines, totals 5.14 and 5.62.
Facts on this page were read 2026-11-04 and the days before it; the date beside each source is the date it was read. Last updated 4 November 2026.