Defender XDR and Sentinel vs Third-Party Tools: The Cost Math

Three decision rules settle most of these comparisons.

1. If the attack path runs through Microsoft Entra ID, Exchange Online, Teams, SharePoint, Windows endpoints and Azure, the Microsoft stack sees it natively. Defender XDR correlates Defender for Endpoint, Defender for Office 365, Defender for Identity and Defender for Cloud Apps into one incident; a third-party SIEM has to be taught those relationships.
2. Keep a third-party tool only where it has telemetry Microsoft does not have in your environment: operational technology, a non-Microsoft identity provider, large non-Windows fleets, an email archive your legal process depends on.
3. Price the three lines together. Licenses are per user per year at list price. Sentinel is per gigabyte, billed by Microsoft on your Azure subscription. People are the line everyone leaves out.

A tool that only repackages Microsoft signals adds a console and an invoice; cut that first.

Per user per year, annual commitment, Microsoft list price, October 2026 price list, billed to you by Microsoft.

For a 100-user Business Premium tenant, the endpoint and email lines are already paid. Adding Defender for Identity and Defender for Cloud Apps costs $10,800 per year; the Defender Suite costs $14,400. Defender for Business vs Plan 1 vs Plan 2 and Mimecast or Proofpoint vs Defender for Office 365 cover the two most common swaps.

Microsoft Sentinel bills on data. The analytics tier, where detection rules run, is charged per gigabyte ingested, either pay-as-you-go or through a commitment tier from 100 GB per day upward; retention beyond 90 days is charged separately. The data lake tier takes high-volume, low-alert data at a lower ingestion and storage rate, with queries billed when you run them. An Azure subscription is required, and the bill is Microsoft's, on that subscription.

The rates this article uses are Microsoft's published East US figures, checked on 11 October 2026; other regions differ, so read your own region's page before budgeting:

• Analytics tier, pay-as-you-go: $4.30 per GB. The 100 GB per day commitment tier is $296 per day.
• Data lake tier: $0.05 per GB ingested, $0.026 per GB per month stored (Microsoft applies a 6:1 compression assumption to storage), and $0.005 per GB analyzed by a query.

Two categories carry no ingestion charge. Microsoft's billing documentation lists Azure Activity logs and the Office 365 audit logs for SharePoint, Exchange admin and Teams activity, plus security alerts from the Defender products, including Defender XDR. Alerts are small; the raw events behind them are charged if you stream them. Second, Microsoft's Sentinel benefit for Microsoft 365 E5, A5, F5, G5 and E7 customers grants up to 5 MB per user per day for Entra ID sign-in and audit logs, Defender for Cloud Apps discovery logs, Purview Information Protection logs and Microsoft 365 advanced hunting data. In a Business Premium or E3 tenant, those identity logs are billed.

The volumes below are our planning assumptions from Sentinel deployments of this shape, not Microsoft figures; measure your own for 14 days with a daily cap before you commit. Monthly cost is 30 days at the East US rates above.

The difference between B and C is routing, not data: the same logs are kept, queried when needed, and cost about $900 a month less. Retention beyond 90 days, Logic Apps playbook actions and any Azure resources around the workspace are extra lines on the same bill. Sentinel for a 100-user organization walks through the connector choices behind these rows.

Five settings decide whether a Sentinel bill looks like scenario A or scenario B.

1. Filter at the source. Data collection rules for servers (the common event set, not all events), firewall log levels, and connector options decide what enters the analytics tier.
2. Route by value. Detection data goes to analytics; verbose allow logs, DNS and application logs go to the data lake tier and are queried when an investigation needs them.
3. Leave endpoint raw events in Defender XDR. Advanced hunting already holds them; stream the alerts, not the events.
4. Set retention per table. A 12-month access-log requirement is an identity-table question, not a reason to keep firewall allows for a year.
5. Separate operational logs. Every table in a Sentinel-enabled workspace carries Sentinel charges; performance telemetry belongs in another workspace.

Only after this is measured does a commitment tier make sense; most organizations under 500 users never reach 100 GB per day.

Replacing everything with Microsoft is not always right. Keep the specialist platform when it provides telemetry or a response action Microsoft does not match in your environment:

• Operational technology. A plant with a mature OT monitoring platform rarely gains from replacing it.
• A non-Microsoft identity provider. If Okta or another provider is the system of record, Defender for Identity sees only the Active Directory side; either the provider's logs go into Sentinel as a paid source, or the migration to Entra ID happens first.
• Large Linux or macOS fleets with a specialist EDR already tuned. A working deployment with runbooks is worth more than a feature table.
• A legal archive or journaling gateway. Swap the filtering, not the archive.
• A SIEM with years of tuned detections. Splunk to Sentinel migration is quoted on request because the detection rewrite is the cost, not the connector.

The comparison method: put the vendor's per-user, per-device and per-gigabyte renewal figures in the same table as the list prices above and the ingestion model, for the same 12 months.

Defender XDR and Sentinel do not become a security operation by being enabled. Someone has to tune the rules, tag privileged users and critical assets, review the queue daily, run the response actions and write the post-incident report. A half-tuned SIEM nobody reads is the most expensive configuration of all: full ingestion cost, no outcome.

Two ways to staff it at fixed prices, quoted in writing before work begins:

• Multi-Platform Managed Detection and Response at $15 per user per month runs the Defender XDR queue, with or without Sentinel: $1,500 per month for 100 users, against the salary of one analyst.
• Microsoft Sentinel SIEM/SOAR implementation at $7,850 per project builds the workspace with the routing above, and ongoing Sentinel monitoring at $15 per user staffs it. Defender XDR incident readiness, $3,500 per project, comes first when the licenses are already owned.

The decision rule: if nobody will look at the console on day 30, buy the managed queue on Defender XDR first and add Sentinel when a non-Microsoft log source needs correlating.

Run the candidate stack against the eight attack paths that actually open Microsoft 365 incidents and time each one from first signal to containment:

1. Password spray followed by a successful sign-in without strong MFA.
2. MFA fatigue prompts accepted on a phone.
3. Token replay from a new device.
4. Malicious OAuth consent to a third-party app.
5. Inbox rule creation that forwards or hides mail.
6. Phishing with post-delivery removal of the message.
7. Privileged role assignment outside change control.
8. Mass SharePoint download after an impossible-travel sign-in.

For each, record the detection time, whether the signals landed in one incident, the analyst steps, the response actions available (revoke sessions, disable the user, isolate the device, remove the mail, block the app) and the false positives. A stack that needs an analyst to rebuild the timeline across three consoles is costing you the third line.

Is Microsoft Sentinel free with Microsoft 365 E5?

No. Microsoft's benefit for E5, A5, F5, G5 and E7 customers grants up to 5 MB per user per day of specific logs (Entra ID sign-in and audit, Defender for Cloud Apps discovery, Purview Information Protection and Microsoft 365 advanced hunting data). Everything else is billed per gigabyte on your Azure subscription, and the grant does not apply to Business Premium or E3 tenants.

What does Sentinel ingest at no charge for everyone?

Microsoft's billing documentation lists Azure Activity logs, Office 365 audit logs for SharePoint, Exchange admin and Teams activity, and security alerts from the Defender products. The raw events behind those alerts are charged if you stream them.

How much does Sentinel cost for 100 users?

With the sources tuned, our planning model lands near 1.75 GB per day, about $226 per month at Microsoft's published East US pay-as-you-go rate of $4.30 per GB. Untuned firewall and DNS logging in the analytics tier can push the same tenant past $1,100 per month; routing those tables to the data lake tier brings it back to about $234.

Do I need Sentinel if I only have Microsoft 365?

Usually not at first. Defender XDR already correlates identity, email, endpoint and SaaS signals into incidents with no ingestion bill. Sentinel earns its place when you need to correlate non-Microsoft sources, keep logs past 90 days for a regulator, or automate response with playbooks.

Can we replace our email gateway with Defender for Office 365?

For filtering, often yes: Plan 1 is included in Business Premium and Plan 2 is $60 per user per year at list price. Keep the gateway if a legal archive or supervision workflow depends on it, and move only the filtering.

What is the cheapest way to get someone watching the alerts?

A managed detection and response service on Defender XDR, $15 per user per month in our catalog, with no Sentinel ingestion bill. Add Sentinel later if a non-Microsoft log source or a retention requirement needs it.

• Microsoft Sentinel pricing — Microsoft Azure, East US rates, checked 2026-10-11
• Plan costs and understand Microsoft Sentinel pricing and billing — Microsoft Learn, checked 2026-10-11
• Microsoft Sentinel benefit for Microsoft 365 E7, E5, A5, F5 and G5 customers — Microsoft Azure, checked 2026-10-11
• Microsoft Sentinel data lake pricing — Microsoft Tech Community, July 2025, checked 2026-10-11
• Microsoft Copilot plans and pricing — Microsoft, for the 300-user cap on Business plans, checked 2026-10-11