Key takeaways
- Microsoft Defender XDR detects and responds to threats on Microsoft-protected endpoints, identities, email and cloud apps. Microsoft Sentinel is a cloud SIEM that takes in data from any source.
- Defender XDR advanced hunting looks back 30 days, while Sentinel keeps data for 90 days free in its analytics tier and longer at a cost.
- Microsoft Defender alerts cost nothing to ingest into Sentinel, but the raw Defender event data behind them is billed per GB.
- Many Microsoft 365 businesses start with Defender XDR alone and add Sentinel when they need to watch non-Microsoft systems or keep logs for audits.
- After 31 March 2027, Sentinel will be available only in the Microsoft Defender portal, where both products share one incident queue.
Microsoft Sentinel and Microsoft Defender XDR are often confused, partly because both sit under Microsoft’s security brand and now share one portal. Defender XDR protects the endpoints, identities, email and cloud apps that Microsoft’s Defender products manage, while Sentinel is the SIEM that collects security data from everything else as well. This guide compares the two side by side, explains how they work together and helps you decide whether you need one or both. For a full introduction to Sentinel, see our Microsoft Sentinel SIEM guide.
What is the difference between Microsoft Sentinel and Microsoft Defender XDR?
Microsoft Defender XDR detects and responds to threats on the endpoints, identities, email and cloud apps that Microsoft’s Defender products protect. Microsoft Sentinel is a cloud SIEM: it collects and correlates security data from every source, Microsoft or not, and adds long-term retention and custom automation. In short, Defender XDR goes deep on Microsoft-protected assets, and Sentinel goes wide across your whole environment.
Microsoft Sentinel vs Microsoft Defender XDR at a glance
Why the two get confused
Both carry Microsoft’s security branding, both raise incidents, and from 2027 both are worked from the same portal. The simplest way to tell them apart is to ask where the data comes from. Defender XDR only sees what Defender products protect. Sentinel sees whatever you connect to it, and that includes Defender XDR itself.
For a broader look at how XDR, SIEM and SOAR differ as categories, read how SIEM and SOAR differ.
What does Microsoft Defender XDR do?
Microsoft Defender XDR combines signals from Microsoft’s Defender products into single incidents. It can also contain attacks automatically, for example by disabling a compromised account before an attacker moves further. Its strength is depth: it sees exactly what happens on the devices, accounts, mailboxes and cloud apps that Defender protects.
The products it brings together:
- Microsoft Defender for Endpoint: laptops, servers and mobile devices
- Microsoft Defender for Identity: on-premises Active Directory and identity attacks
- Microsoft Defender for Office 365: email, phishing and collaboration tools
- Microsoft Defender for Cloud Apps: SaaS applications and shadow IT
What it does with those signals:
- Correlates alerts into incidents. A phishing email, the device that opened it and the account that signed in afterwards appear as one incident instead of three separate alerts.
- Disrupts attacks automatically. Automatic attack disruption can contain compromised users and devices during attacks such as ransomware or business email compromise. It needs Microsoft Defender for Endpoint Plan 2.
- Lets analysts hunt. Advanced hunting runs queries across 30 days of Defender data to find threats no alert caught.
- Takes response actions. Analysts can isolate a device, reset a user’s sessions or remove a malicious email from every mailbox, all from the Defender portal.
Where the name came from
Microsoft Defender XDR was previously called Microsoft 365 Defender, and before that Microsoft Threat Protection. Microsoft announced the new name at Ignite 2023 to reflect its wider coverage across platforms and clouds. Searches for “Microsoft 365 Defender” now refer to the same product.
Defender XDR on its own, or with a managed service
Defender XDR raises the alerts, but someone still has to triage them, act on the real ones and close the rest. Microsoft offers its own managed service, and you can compare it with independent providers in Defender Experts vs third-party MDR.
What does Microsoft Sentinel add on top of Defender XDR?
Microsoft Sentinel adds the data Defender XDR can’t see, such as firewalls, other clouds and business applications. It also adds longer retention, custom detections across all of that data, and automation through playbooks. Defender XDR tells you what happened on Microsoft-protected assets. Sentinel connects those events with everything else in your environment.
1. Data from non-Microsoft systems
Sentinel takes in logs from firewalls, VPNs, AWS and Google Cloud, Linux servers and business applications through data connectors, Syslog, CEF or a REST API. An attack that starts at the firewall and ends in a Microsoft 365 mailbox only shows as one story when both sources sit in the same place. If you’re comparing Sentinel with another SIEM for that job, read Microsoft Sentinel vs Splunk.
2. Longer retention for investigations and audits
Defender XDR advanced hunting looks back 30 days. Sentinel keeps data for 90 days free in its analytics tier, and for longer in the analytics tier or the cheaper Sentinel data lake. That matters when an attack is discovered months after it began, or when an auditor asks for a year of sign-in history.
3. Custom detections across all your data
Analytics rules in Sentinel can look for patterns that span several sources. For example, a VPN login from an unusual country followed by a mass file download from SharePoint. Neither alert would fire on its own.
4. Automation into the rest of your tools
Playbooks, built on Azure Logic Apps, connect incidents to systems outside Microsoft security. They can open a ServiceNow ticket, post to a Slack or Teams channel, or block an IP address on a third-party firewall.
5. Reporting for leadership and compliance
Workbooks turn the data into dashboards for incident trends, data source health and compliance reporting, across every connected system rather than Defender alone.
The cost of the extra coverage
Defender XDR comes with your Microsoft licences, while Sentinel is billed per GB of data ingested. Defender alerts flow into Sentinel at no ingestion cost, so the bill grows with the non-Microsoft and raw log data you add. Our guide to Microsoft Sentinel pricing shows what that means in practice.
Do you need both Microsoft Sentinel and Defender XDR?
Many Microsoft 365 businesses start with Defender XDR alone and add Microsoft Sentinel when they need to watch non-Microsoft systems, keep security logs for longer than 30 days of hunting, or meet audit requirements. The two don’t compete: Sentinel builds on Defender XDR rather than replacing it.
Defender XDR alone or Defender XDR plus Sentinel
A common path
Most organisations don’t choose one or the other on day one. They switch on Defender XDR with their Microsoft 365 licences, then connect Sentinel when a new requirement appears: a compliance audit, a cyber insurance questionnaire, or a firewall the security team can’t see into. Because Defender alerts flow into Sentinel at no ingestion cost, adding Sentinel doesn’t mean paying twice for the same alerts.
What both still need
Neither product watches itself. Both raise incidents that someone has to triage around the clock, and both need detection rules tuned over time. That workload is often what decides how far a business can take either one with its own team. Our guide to what it takes to run Microsoft Sentinel well breaks it down task by task.
Book a call with CyberQuell to have Microsoft Sentinel and Defender XDR monitored together, 24/7, with a 15-minute response SLA on critical and high-severity alerts.
How do Microsoft Sentinel and Defender XDR work together?
Microsoft Defender XDR alerts and incidents flow into Microsoft Sentinel through a built-in connector, and Defender alerts cost nothing to ingest. You can also send raw Defender data to Sentinel to keep it for longer than 30 days, but that is billed at normal ingestion prices. In the Defender portal, both products then share one incident queue.
1. The Defender XDR connector
The Microsoft Defender XDR connector sends Defender incidents and alerts into Sentinel and keeps them in sync. An incident closed in one product shows as closed in the other, so analysts don’t work the same attack twice.
2. Alerts are free, raw data is not
Security alerts from Defender products cost nothing to ingest. The raw event tables behind them, such as device process events or email events, are billed per GB like any other source. Most businesses bring in all the alerts and only the raw tables their custom detections or investigations need. Microsoft 365 E5 customers get some of that raw data free through the 5 MB per user per day benefit.
3. Keeping Defender data for longer
Defender XDR advanced hunting covers 30 days. To hunt further back, Microsoft’s guidance is to send the supported Defender tables to a Sentinel workspace and set their retention there. Logs you need to keep but rarely search can go to the cheaper Sentinel data lake.
4. Detections that span both products
In the Defender portal, custom detection rules can query Sentinel and Defender XDR tables together. You don’t need to ingest the Defender data first, as long as 30 days of Defender history is enough for the rule. This avoids paying to copy data just to write one detection.
5. One incident queue
Once Sentinel is onboarded to the Defender portal, the Defender XDR correlation engine groups related alerts from both products into single incidents. An alert from a third-party firewall in Sentinel and an alert from Defender for Endpoint can end up in the same incident. Analysts see the whole attack in one place.
To see what the raw data you choose to ingest would cost, use the worked examples in our guide to Microsoft Sentinel pricing.
What changes when Microsoft Sentinel moves into the Defender portal in 2027?
After 31 March 2027, Microsoft Sentinel will be available only in the Microsoft Defender portal, where Sentinel and Defender XDR incidents share one queue. Sentinel still works there without a Defender XDR licence, and the move costs nothing extra. Microsoft Sentinel is not going away: only the Azure portal experience is retiring.
What stays the same
- Your Sentinel workspace, data and Log Analytics storage
- Your Sentinel bill, which is still based on the data you ingest
- Analytics rules, workbooks and non-Microsoft data connectors
What changes for analysts and automation
- One incident queue. The Defender XDR engine correlates alerts from both products into combined incidents.
- Fusion is switched off. The Fusion detection rule is disabled, and the Defender XDR engine takes over alert correlation, so no correlation is lost.
- A new provider name. Every incident shows “Microsoft XDR” as its provider, and the incident provider condition is removed from automation rules.
- Short delays. Playbooks may trigger up to 5 minutes later than before, and automation rules up to 10 minutes later.
- Ticketing changes. Incident descriptions no longer sync to ticketing tools such as ServiceNow, so those integrations need testing.
Are you already there?
Since July 2025, most new Sentinel customers have been onboarded to the Defender portal automatically. If your team still opens Sentinel from the Azure portal, you have until 31 March 2027 to move. Our Microsoft Sentinel SIEM guide includes a five-step checklist to work through before you switch.
Which Microsoft Defender is which?
“Microsoft Defender” covers several products. Defender XDR is the umbrella that correlates the others, Defender for Endpoint, Identity, Office 365 and Cloud Apps each protect one area, and Defender for Cloud protects cloud workloads. Microsoft Sentinel sits alongside all of them as the SIEM that collects their alerts with everything else.
The one that causes most confusion
Microsoft Defender for Cloud is often mistaken for Defender XDR or for Sentinel. Defender for Cloud protects cloud workloads and checks their security settings. Defender XDR protects users, devices and email. Sentinel is the SIEM that collects alerts and logs from both, plus everything outside Microsoft.
If you want Defender’s endpoint, email and identity protection run as one managed service, see CyberQuell’s managed XDR services
Final Thoughts
Microsoft Defender XDR and Microsoft Sentinel do different jobs. Defender XDR goes deep on the devices, accounts, mailboxes and cloud apps that Microsoft protects, and can stop an attack there automatically. Sentinel goes wide, collecting data from every system you run and keeping it long enough for investigations and audits. For most Microsoft 365 businesses, the question isn’t which one to pick but when to add Sentinel to the Defender XDR they already have.
From 31 March 2027, both are worked from one portal and one incident queue, which makes running them together simpler. Neither runs itself, though. Both raise incidents that need someone watching around the clock, and both need detection rules tuned as your environment changes. To see what adding Sentinel would cost, start with our guide to Microsoft Sentinel pricing. Book a call with CyberQuell to get Microsoft Sentinel and Defender XDR monitored 24/7, with a 15-minute response SLA on critical and high-severity alerts and your workspace kept in your own tenant.
.png)
