Microsoft Sentinel Implementation — SharePoint File Access & Permission Monitoring

This service includes setup of a focused Microsoft Sentinel configuration to monitor agreed file access and permission-change events in SharePoint Online, OneDrive, and Microsoft Teams. IT Partner configures required connectors, custom analytics rules, automation rules, and Azure Logic Apps so selected events can generate notifications and Microsoft Sentinel incidents for investigation.

The service focuses on detecting configured events such as opening or downloading specified files or folders and making permission changes that affect those items. For example, it can notify stakeholders and create a Microsoft Sentinel incident if an administrator adds themselves as a site member to access sensitive data, provided that scenario is included in the approved rule configuration.

No, this service provides detection and notification, not access prevention. Microsoft Sentinel can help identify and escalate configured file access or permission-change events, but preventing unauthorized access would require other controls outside this service scope.

The service includes configuring Microsoft Sentinel for the agreed monitoring scenarios, including connectors, analytics rules, automation rules, and notifications. The client must provide access to the tenant and Azure subscription, and IT Partner should confirm whether a Microsoft Sentinel instance already exists or must be provisioned during the engagement.

The stated duration for this service is 5 days. The engagement includes kickoff, information gathering, rule planning and approval, subscription provisioning as needed, implementation, testing, and demonstration.

The stated price for this service is $1,500. The service plan may vary depending on the client’s needs, so any changes to scope, scenarios, or requirements should be confirmed with IT Partner before work begins.

The client must provide access to the Microsoft 365 tenant and Azure subscription, along with the information needed to configure the monitoring rules. The service success criteria also reference an Azure subscription with a Microsoft Sentinel instance, so clients should confirm with IT Partner whether Sentinel must already be deployed before kickoff.

The client needs to identify the files, folders, sites, users, events, and notification scenarios that should be monitored. This information is required because IT Partner configures custom analytics and automation rules around the agreed scenarios rather than applying a generic monitoring policy to all content.

IT Partner is responsible for gathering required implementation information, setting up Microsoft Sentinel, configuring required connectors, enabling custom analytics rules, configuring automation rules and Azure Logic Apps, and performing tests. IT Partner also demonstrates the implemented scenarios after testing is complete.

The client is responsible for providing access to the tenant and Azure subscription and supplying the information needed for rule configuration. The client also participates in approving the planned rules and confirming that the tested scenarios meet the agreed requirements.

The service can configure notifications for agreed scenarios, such as downloading or opening a specified file or making permission changes to selected content. Notifications may be delivered through configured automation such as email or Microsoft Teams messages, depending on the approved design and Azure Logic Apps configuration.

Yes, for configured scenarios, the service enables Microsoft Sentinel incidents to support additional investigation. Incidents are created based on the custom analytics rules and automation configured during the engagement, not for every possible SharePoint, OneDrive, or Teams activity by default.

The service is designed to monitor access and permission changes for specified files or folders, not necessarily every file across the entire tenant. The exact monitoring scope depends on the scenarios and rule requirements approved during the planning phase.

The provided service scope does not identify planned downtime. Because the work centers on Microsoft Sentinel configuration, connectors, analytics rules, automation rules, and testing, any operational impact should be confirmed with IT Partner based on the client’s tenant and Azure environment.

The engagement starts with a kickoff meeting, followed by information gathering and planning of the required rules. IT Partner then provisions appropriate subscriptions as needed, implements the Microsoft Sentinel configuration, performs testing, and demonstrates the configured monitoring and notification scenarios.

IT Partner tests the desired scenarios and tasks to confirm that the configured rules, notifications, and incidents work as expected. Completion is based on Microsoft Sentinel being configured according to the client’s requirements and the agreed scenarios being successfully tested and confirmed.

This service does not include prevention of unauthorized access, Azure Information Protection implementation, or Data Loss Prevention policy implementation. Those controls are separate from the Microsoft Sentinel detection and notification scope and may require additional planning, complexity, and end-user participation.

No, this service should not be treated as a replacement for Data Loss Prevention or Azure Information Protection. It detects and notifies on configured access or permission-change events, while DLP and Azure Information Protection are separate services focused on policy enforcement, classification, and protection scenarios.

After completion, the client receives a tested Microsoft Sentinel configuration for the agreed file access and permission-change monitoring scenarios. The service includes demonstration of the implemented solution, but ongoing monitoring, continuous monitoring, 24/7 support, ongoing maintenance, tuning, or additional scenarios are not included by default and are available as optional extra-cost add-ons through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement when contracted separately with IT Partner.