Microsoft Sentinel is a world-class SIEM. It's also a line item that can consume an entire mid-market cyber budget if it's deployed before the organisation is ready for it. The question isn't whether Sentinel is good — it's whether it's the right control for your current posture.
What Sentinel actually is
Sentinel is a cloud-native SIEM + SOAR. It ingests logs from Microsoft 365, Entra ID, Defender, Azure, on-premises systems and third parties. It runs analytics rules against those logs. It correlates alerts into incidents. It automates response actions via playbooks.
The cost model is per gigabyte ingested per day. A small tenant might run at $500/mo; an enterprise with full-fidelity on-prem ingestion can hit six figures per month. The cost is dominated by what you decide to log, not by Sentinel itself.
What you get from Defender XDR without Sentinel
Microsoft Defender XDR is the consolidated view across Defender for Endpoint, Office 365, Identity and Cloud Apps. It does cross-product correlation, incident aggregation and automated investigation — all native, all included in E5 or the relevant add-ons.
For most mid-market Australian businesses running a pure Microsoft 365 stack with no significant on-prem or third-party footprint, Defender XDR does 80% of what Sentinel would do. That's the test: how much of your attack surface lives outside the Microsoft stack?
When Sentinel is the right answer
- Regulated industry (APRA-regulated, ASX-listed, government-adjacent) with formal SOC obligations and audit requirements.
- Significant non-Microsoft telemetry — firewalls, line-of-business apps, SaaS tools outside the Microsoft stack — where Defender XDR can't see.
- A maturing SOC that needs KQL hunting, custom detections, formal MITRE mapping and threat-intel integration.
- M&A or multi-tenant environments where correlation across Entra tenants is a requirement.
- Compliance regimes (ISO 27001, SOC 2, IRAP) that require a formal SIEM with documented retention and analyst workflow.
When Defender XDR is enough
- Predominantly Microsoft 365 tenant, modest Azure footprint, few SaaS integrations.
- No dedicated SOC — the IT team or a partner MSP does incident triage.
- No regulatory requirement for SIEM-grade logging and retention.
- Cyber program maturing through the Essential Eight, not yet through advanced detection engineering.
If you're in this bucket and someone's quoted you $10,000/mo for a Sentinel deployment, ask the hard questions. What telemetry are you ingesting that Defender XDR doesn't already see? What detections are you writing that Defender doesn't already run? If the answers are thin, the Sentinel build will be thin too.
Where Sentinel earns its keep at smaller scale
For organisations growing into SIEM but not yet running a full SOC, the pragmatic architecture is: Defender XDR as the primary investigation surface, Sentinel wired in only for the non-Microsoft telemetry that matters, and the Defender XDR → Sentinel integration switched on so incidents stream in both directions.
You pay Sentinel cost proportional to the external telemetry you genuinely need, not for duplicating what Defender already has. This is where we deploy Sentinel most often.
Try it
Fix the foundations before you shop SIEM
Sentinel on top of an ML0 Essential Eight posture doesn't improve security — it just logs the incidents earlier. Run the tool and see where your real gaps are.
Score each of the 8 strategies
Where are you on the Essential Eight — honestly?
Eight strategies. Four levels each. Pick the statement closest to your reality today. We'll map it to the Microsoft 365 tooling that closes the gap.
What's your target Maturity Level?
Maturity Level 2 — most orgs' pragmatic target
- 01
Application control
Only approved applications can execute on workstations and servers.
- 02
Patch applications
Internet-facing apps, browsers, Office, PDF readers patched promptly.
- 03
Microsoft Office macros
Macros disabled unless from trusted locations and signed by a trusted publisher.
- 04
User application hardening
Web browsers and productivity apps hardened against the most common attacks.
- 05
Restrict administrative privileges
Admin accounts limited, separated and reviewed — the crown jewels of the tenant.
- 06
Patch operating systems
Operating system patches applied on a schedule that matches the risk.
- 07
Multi-factor authentication
MFA everywhere that matters — privileged accounts, remote access, important data.
- 08
Regular backups
Backups of important data, configuration and software — and restores you have actually tested.
Foundations first, SIEM second
A Sentinel deployment makes sense when you've already done the Essential Eight work. Patching, MFA, privileged access, application control, backups — those controls prevent incidents. Sentinel helps you see them. Without the preventative controls, Sentinel is a very expensive incident-logger.
The sequence we recommend: Essential Eight to ML2 → Defender XDR operational → measure incident volume for 90 days → decide whether Sentinel is the next investment or whether the next dollar goes to ML3 uplift, capability building or something else entirely.
If you're weighing up a Sentinel deployment, or someone is trying to sell you one, book a chat. We'll give you an honest read on whether your environment actually needs it — or whether the budget is better spent elsewhere this year.