Managed Detection and Response (MDR) on Microsoft Sentinel — Managed Threat Monitoring & Response
Managed Detection and Response (MDR) on Microsoft Sentinel is an ongoing monthly managed security service that extends an existing Microsoft Sentinel deployment with threat detection, alert triage, incident response, containment playbooks, and monthly security reporting. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default, but are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
What this engagement is
This service extends an existing Microsoft Sentinel SIEM/SOAR deployment into a recurring managed detection and response service. IT Partner onboards data sources and detections into Sentinel, tunes analytics rules to reduce noise, provides managed alert review and triage within the agreed service coverage, runs incident response and containment playbooks, and delivers periodic threat reporting. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement. The service is SKU PROPOSED-MDR-001, delivered on an ongoing monthly basis, and priced as a monthly managed service scoped by data volume and endpoint count.
Success criteria
What you receive
How the work unfolds
— Service kickoff and scope confirmation: confirm the Sentinel workspace or workspaces in scope, data sources, endpoint counts, ingestion expectations, response authority, escalation contacts, reporting recipients, and any client-specific compliance or business constraints.
— Access and readiness validation: validate IT Partner access to Microsoft Sentinel, Microsoft Defender, Azure subscriptions, Log Analytics workspaces, automation accounts, Logic Apps, and relevant Microsoft Entra ID roles; review licensing, data retention, connector health, and existing SIEM/SOAR configuration.
— Data source and detection onboarding: onboard or validate agreed data connectors and detection content for Microsoft Sentinel and Microsoft Defender signals, prioritizing high-value identity, endpoint, cloud, network, and security telemetry already available to the client.
— Analytics rule tuning and baseline: review existing analytics rules, map priority detections to the client environment, suppress known benign activity where appropriate, tune severity and entity mapping, and establish an initial alert baseline to reduce noise.
— SOAR and containment playbook configuration: implement or refine agreed Sentinel automation rules and SOAR playbooks for repeatable triage, notification, evidence collection, enrichment, ticket creation, and containment actions where the client has approved automation.
— Operational runbook and escalation setup: document triage categories, escalation paths, notification methods, incident severity handling, client approval requirements, and handoff procedures for incidents that require client action or broader remediation.
— Service transition and steady-state operations: move into recurring MDR operations with alert triage, incident response activities, rule tuning within the agreed service coverage, and monthly security reporting.
Prerequisites
Who does what
IT Partner
- Onboard data sources and detections into Sentinel
- Tune analytics rules and reduce noise
- Provide alert triage within the agreed service coverage
- Run incident response and containment playbooks
- Deliver periodic threat reporting
Your team
- — Maintain the Microsoft licensing, Azure subscription, Microsoft Sentinel workspace, Log Analytics ingestion, and Microsoft Defender services required for the agreed monitoring scope.
- — Provide timely administrative access, delegated permissions, or approved partner access required for Sentinel, Defender, Azure, Microsoft Entra ID, automation, and reporting activities.
- — Identify business owners, technical contacts, and security escalation contacts who can respond to incident notifications and approve containment or remediation actions when required.
- — Confirm the approved response authority for IT Partner, including which automated or manual containment actions may be taken without additional approval and which require client authorization.
- — Provide context for known applications, privileged accounts, service accounts, business-critical systems, maintenance windows, expected administrative activity, and accepted risks so detections can be tuned responsibly.
- — Perform or approve remediation activities that remain under client control, such as user communication, business application changes, endpoint rebuilds, third-party vendor coordination, and policy decisions.
- — Review monthly security reports and participate in periodic service reviews, prioritization discussions, and improvement planning.
What's not included
Limitations & technical notes
Frequently asked questions
What is Managed Detection and Response (MDR) on Microsoft Sentinel?
Managed Detection and Response (MDR) on Microsoft Sentinel is an ongoing monthly managed security service that extends an existing Microsoft Sentinel SIEM/SOAR deployment with threat detection, alert triage, incident response, containment playbooks, and monthly security reporting. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default, but are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
Who is this MDR service for?
This service is for organizations that already have Microsoft Sentinel deployed and want ongoing managed detection and response on top of it. It is not described as a one-time setup project; it is a recurring monthly managed service for monitoring within the agreed service coverage, triage, response, and reporting. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional paid add-ons.
What is included in the MDR on Microsoft Sentinel service?
The service includes a tuned detection ruleset, alert triage within the agreed service coverage, incident response, automated SOAR playbooks, and monthly security reporting. IT Partner also onboards data sources and detections into Sentinel and tunes analytics rules to reduce noise. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default and are available as optional extra-cost add-ons.
What are the prerequisites for this service?
The stated prerequisite is an existing Microsoft Sentinel deployment with existing Sentinel SIEM/SOAR work that IT Partner can build on. If Sentinel is not already deployed, confirm with IT Partner whether a separate Sentinel deployment or readiness engagement is required before MDR can begin.
Does this service include deploying Microsoft Sentinel from scratch?
The stated scope assumes an existing Microsoft Sentinel deployment, so a net-new Sentinel deployment is not listed as part of this MDR service. If you need Sentinel designed, deployed, or licensed first, confirm the required prerequisite work with IT Partner.
What does IT Partner do during the monthly MDR service?
IT Partner onboards data sources and detections into Sentinel, tunes analytics rules, reduces alert noise, provides alert triage within the agreed service coverage, runs incident response and containment playbooks, and delivers periodic threat reporting. 24/7 support, continuous monitoring, and ongoing maintenance are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement.
What does continuous monitoring and alert triage mean in this service?
Continuous monitoring is not included by default in this service. It is available as an optional extra-cost add-on delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement. Alert triage within the agreed service coverage helps separate actionable security incidents from noise so response efforts can focus on meaningful threats.
How does the service reduce false positives and alert noise?
IT Partner tunes Microsoft Sentinel analytics rules and detection logic to reduce noise. This matters because excessive false positives can overwhelm security teams and make real incidents harder to identify.
What incident response is included?
Incident response is included as part of the monthly MDR service, including running response and containment playbooks through the Sentinel/SOAR environment. The exact response actions, escalation process, and authority to contain systems should be confirmed with IT Partner because the source scope does not define every operational decision point.
Are automated SOAR playbooks included?
Yes, automated SOAR playbooks are listed as a deliverable of the service. These playbooks support repeatable response and containment workflows in Microsoft Sentinel, although the specific playbooks and automation permissions should be confirmed during scoping.
What kind of reporting is provided?
The service includes monthly security reporting and periodic threat reporting. The report format, metrics, recipient list, and review cadence beyond the stated monthly reporting should be confirmed with IT Partner.
How is the service priced?
The service is priced as a monthly managed service scoped by data volume and endpoint count. Exact pricing is not stated in the service description, so IT Partner will need to confirm the monthly cost based on your Sentinel data ingestion volume and endpoint scope.
Is this a one-time project or an ongoing service?
This is an ongoing monthly managed service, not a one-time implementation. Its purpose is to provide monitoring according to the agreed service coverage, detection, triage, response, and reporting after the initial onboarding and tuning work begins. 24/7 support, continuous monitoring, and ongoing maintenance are optional extra-cost add-ons and are not included by default.
How long does onboarding take?
The source content does not provide a fixed onboarding timeline or milestone sequence. IT Partner should confirm the implementation plan, expected onboarding duration, and any phased rollout based on the number of data sources, detections, and endpoints in scope.
Will this service cause downtime or business disruption?
The service description does not state any expected downtime. Because the work focuses on Microsoft Sentinel monitoring, detections, analytics tuning, and SOAR playbooks, business impact is typically tied to response or containment actions, so approval paths and automation behavior should be confirmed before playbooks are enabled.
What are IT Partner’s responsibilities?
IT Partner is responsible for onboarding data sources and detections into Sentinel, tuning analytics rules to reduce noise, providing alert triage within the agreed service coverage, running incident response and containment playbooks, and delivering periodic threat reporting. 24/7 support, continuous monitoring, and ongoing maintenance are not included by default and are available as optional paid add-ons.
What are the client’s responsibilities?
The source content does not define detailed client responsibilities. At minimum, the client must have an existing Microsoft Sentinel deployment for IT Partner to build on, and any access, approvals, escalation contacts, containment authority, or internal response responsibilities should be confirmed with IT Partner before service start.
What is not included in the service?
24/7 support, continuous monitoring, and ongoing maintenance are not included by default; they are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement. Because the service is specifically described as MDR on an existing Microsoft Sentinel deployment, items such as new Sentinel deployment, unrelated security tooling, remediation projects, or custom integrations should be treated as unconfirmed unless IT Partner includes them in the proposal.
What happens after the initial onboarding and tuning?
After onboarding and tuning, the service continues as a monthly managed MDR engagement. IT Partner continues monitoring Sentinel according to the agreed service coverage, triaging alerts, responding to incidents, running containment playbooks where applicable, and delivering monthly security reporting. Continuous monitoring is available only as an optional paid add-on.
How is success measured for this service?
Success is measured by having an actively defended environment, an existing Sentinel deployment that is monitored according to the agreed service coverage, and ongoing threat detection, triage, and response delivered as a managed service. Continuous monitoring and 24/7 support are optional paid add-ons, not default inclusions. The intended outcome is that Microsoft Sentinel is used operationally for defense rather than only collecting logs.