Managed Detection and Response (MDR) on Microsoft Sentinel
Managed Detection and Response on Microsoft Sentinel is an ongoing service for agreed Sentinel data sources, detections, incidents, coverage hours, and response procedures. IT Partner onboards or validates the monitored scope, tunes analytics and automation, triages incidents within contracted service levels, coordinates approved containment actions, and provides recurring reporting. Monthly pricing depends on data volume, endpoints, integrations, coverage window, retention, and response obligations; 24/7 coverage and major-incident labor are included only when the contract explicitly says so.
What this engagement is
A managed Sentinel service requires precise operational boundaries. The statement of work defines who monitors which workspaces and sources, when analysts are available, how severity and escalation work, which playbooks may run automatically, what the client must approve, and which costs remain with Microsoft. Playbooks use Azure Logic Apps and require explicit permissions and change control. The service reduces detection and response risk but cannot guarantee that every threat will be detected or prevented.
Success criteria
What you receive
How the work unfolds
Service kickoff and scope confirmation: confirm the Sentinel workspace or workspaces in scope, data sources, endpoint counts, ingestion expectations, response authority, escalation contacts, reporting recipients, and any client-specific compliance or business constraints.
Access and readiness validation: validate IT Partner access to Microsoft Sentinel, Microsoft Defender, Azure subscriptions, Log Analytics workspaces, automation accounts, Logic Apps, and relevant Microsoft Entra ID roles; review licensing, data retention, connector health, and existing SIEM/SOAR configuration.
Data source and detection onboarding: onboard or validate agreed data connectors and detection content for Microsoft Sentinel and Microsoft Defender signals, prioritizing high-value identity, endpoint, cloud, network, and security telemetry already available to the client.
Analytics rule tuning and baseline: review existing analytics rules, map priority detections to the client environment, suppress known benign activity where appropriate, tune severity and entity mapping, and establish an initial alert baseline to reduce noise.
SOAR and containment playbook configuration: implement or refine agreed Sentinel automation rules and SOAR playbooks for repeatable triage, notification, evidence collection, enrichment, ticket creation, and containment actions where the client has approved automation.
Operational runbook and escalation setup: document triage categories, escalation paths, notification methods, incident severity handling, client approval requirements, and handoff procedures for incidents that require client action or broader remediation.
Service transition and steady-state operations: move into recurring MDR operations with alert triage, incident response activities, rule tuning within the agreed service coverage, and monthly security reporting.
Prerequisites
Who does what
IT Partner
- Onboard data sources and detections into Sentinel
- Tune analytics rules and reduce noise
- Provide alert triage within the agreed service coverage
- Run incident response and containment playbooks
- Deliver periodic threat reporting
Your team
- Maintain the Microsoft licensing, Azure subscription, Microsoft Sentinel workspace, Log Analytics ingestion, and Microsoft Defender services required for the agreed monitoring scope.
- Provide timely administrative access, delegated permissions, or approved partner access required for Sentinel, Defender, Azure, Microsoft Entra ID, automation, and reporting activities.
- Identify business owners, technical contacts, and security escalation contacts who can respond to incident notifications and approve containment or remediation actions when required.
- Confirm the approved response authority for IT Partner, including which automated or manual containment actions may be taken without additional approval and which require client authorization.
- Provide context for known applications, privileged accounts, service accounts, business-critical systems, maintenance windows, expected administrative activity, and accepted risks so detections can be tuned responsibly.
- Perform or approve remediation activities that remain under client control, such as user communication, business application changes, endpoint rebuilds, third-party vendor coordination, and policy decisions.
- Review monthly security reports and participate in periodic service reviews, prioritization discussions, and improvement planning.
What's not included
Limitations & technical notes
Frequently asked questions
What is Managed Detection and Response (MDR) on Microsoft Sentinel?
Managed Detection and Response (MDR) on Microsoft Sentinel is an ongoing monthly managed security service that extends an existing Microsoft Sentinel SIEM/SOAR deployment with threat detection, alert triage, incident response, containment playbooks, and monthly security reporting. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default, but are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
Who is this MDR service for?
This service is for organizations that already have Microsoft Sentinel deployed and want ongoing managed detection and response on top of it. It is not described as a one-time setup project; it is a recurring monthly managed service for monitoring within the agreed service coverage, triage, response, and reporting. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional paid add-ons.
What is included in the MDR on Microsoft Sentinel service?
The contract defines the monitored workspaces and data sources, coverage hours, detection content, triage and escalation process, response authority, reporting, service levels, and Microsoft costs. 24/7 coverage and major-incident labor are included only when explicitly stated.
What are the prerequisites for this service?
The stated prerequisite is an existing Microsoft Sentinel deployment with existing Sentinel SIEM/SOAR work that IT Partner can build on. If Sentinel is not already deployed, confirm with IT Partner whether a separate Sentinel deployment or readiness engagement is required before MDR can begin.
Does this service include deploying Microsoft Sentinel from scratch?
A full greenfield Sentinel implementation is not assumed. Onboarding can include validating or adding agreed sources and detections, while workspace architecture, large migrations, and extensive connector deployment require explicit scope.
What does IT Partner do during the monthly MDR service?
IT Partner onboards data sources and detections into Sentinel, tunes analytics rules, reduces alert noise, provides alert triage within the agreed service coverage, runs incident response and containment playbooks, and delivers periodic threat reporting. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
What does continuous monitoring and alert triage mean in this service?
Continuous monitoring is not included by default in this service. It is available as an optional extra-cost add-on delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement. Alert triage within the agreed service coverage helps separate actionable security incidents from noise so response efforts can focus on meaningful threats.
How does the service reduce false positives and alert noise?
IT Partner tunes Microsoft Sentinel analytics rules and detection logic to reduce noise. This matters because excessive false positives can overwhelm security teams and make real incidents harder to identify.
What incident response is included?
Analysts investigate and coordinate response within the contracted severity, coverage, labor, and authority boundaries. Forensic services, legal or breach counsel, crisis communications, ransomware negotiation, and unlimited major-incident labor are separate unless expressly included.
Are automated SOAR playbooks included?
Approved Microsoft Sentinel automation rules and Azure Logic Apps playbooks may be configured or tuned. Each playbook requires testing, permissions, change control, and a documented decision about automatic versus human-approved actions.
What kind of reporting is provided?
The service includes monthly security reporting and periodic threat reporting. The report format, metrics, recipient list, and review cadence beyond the stated monthly reporting should be confirmed with IT Partner.
How is the service priced?
The service is priced as a monthly managed service scoped by data volume and endpoint count. Exact pricing is not stated in the service description, so IT Partner will need to confirm the monthly cost based on your Sentinel data ingestion volume and endpoint scope.
Is this a one-time project or an ongoing service?
This is an ongoing monthly managed service, not a one-time implementation. Its purpose is to provide monitoring according to the agreed service coverage, detection, triage, response, and reporting after the initial onboarding and tuning work begins. 24/7 support, continuous monitoring, and ongoing maintenance are optional extra-cost add-ons and are not included by default.
How long does onboarding take?
The source content does not provide a fixed onboarding timeline or milestone sequence. IT Partner should confirm the implementation plan, expected onboarding duration, and any phased rollout based on the number of data sources, detections, and endpoints in scope.
Will this service cause downtime or business disruption?
The service description does not state any expected downtime. Because the work focuses on Microsoft Sentinel monitoring, detections, analytics tuning, and SOAR playbooks, business impact is typically tied to response or containment actions, so approval paths and automation behavior should be confirmed before playbooks are enabled.
What are IT Partner’s responsibilities?
IT Partner is responsible for onboarding data sources and detections into Sentinel, tuning analytics rules to reduce noise, providing alert triage within the agreed service coverage, running incident response and containment playbooks, and delivering periodic threat reporting. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default and are available as optional paid add-ons.
What are the client’s responsibilities?
The source content does not define detailed client responsibilities. At minimum, the client must have an existing Microsoft Sentinel deployment for IT Partner to build on, and any access, approvals, escalation contacts, containment authority, or internal response responsibilities should be confirmed with IT Partner before service start.
What is not included in the service?
24/7 support, continuous monitoring, and ongoing maintenance are not included by default; they are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement. Because the service is specifically described as MDR on an existing Microsoft Sentinel deployment, items such as new Sentinel deployment, unrelated security tooling, remediation projects, or custom integrations should be treated as unconfirmed unless IT Partner includes them in the proposal.
What happens after the initial onboarding and tuning?
After onboarding and tuning, the service continues as a monthly managed MDR engagement. IT Partner continues monitoring Sentinel according to the agreed service coverage, triaging alerts, responding to incidents, running containment playbooks where applicable, and delivering monthly security reporting. Continuous monitoring is available only as an optional paid add-on.
How is success measured for this service?
Success is measured by having an actively defended environment, an existing Sentinel deployment that is monitored according to the agreed service coverage, and ongoing threat detection, triage, and response delivered as a managed service. Continuous monitoring and 24/7 support are optional paid add-ons, not default inclusions. The intended outcome is that Microsoft Sentinel is used operationally for defense rather than only collecting logs.