A new foundation for agentic security

ISOC in Defender expands the value of Microsoft 365 E5 and E7 with security operations capabilities such as workbooks and NL to SOAR, that previously required a separate Sentinel purchase. It brings together leading XDR & SIEM, threat intelligence, automation, and AI capabilities in the Defender experience, helping customers get more value from security investments they already made. ISOC is not a new standalone product.

• Built for the agentic security: Give analysts and agents the shared signals, context, and controls to see, understand, and act across the environment.
• Integrated protection loop: Unified operations centered in threat-led workflows. Connecting post breach to pre-breach actions.
• Designed for practitioners: An experience built as one product, system and data model. Bringing agents and humans together in the flow of work. 

ISOC eligibility requires an active Microsoft Defender Suite, Microsoft 365 E5 or E7 license, and an Azure subscription. This includes eligible customers in government and sovereign cloud environments.

The following are not eligible for ISOC:

• Security mini suites and standalone security suites 
• Education (EDU) and Frontline (F) SKUs

Included Defender data sources are:

• Microsoft Defender for Endpoint
• Microsoft Defender for Office 365
• Microsoft Defender for Identity
• Microsoft Defender for Cloud Apps
• Microsoft Defender for Cloud
• Microsoft Entra Identity Protection logs
• Azure Activity / audit logs (via connector)

No. There is no minimum seat threshold for eligible Microsoft 365 E5 and E7 customers. Standard product terms apply.

There is no change for customers currently using Microsoft Sentinel. The current Microsoft Sentinel offering will continue to exist as is. Existing Microsoft Sentinel customers will have the choice to move to ISOC starting November 15, 2026 if they meet the relevant licensing eligibility criteria.