Sentinel Integrated into Defender XDR

• Microsoft’s Sentinel Security Information and Event Management (SIEM) has been integrated into Microsoft Defender XDR.
• Security analysts can now investigate incidents from the same portal.
• Expect future Sentinel enhancements to require using the Defender XDR portal, not the Azure portal.
• This change has no effect on the licensing of Sentinel or Defender XDR components.

Microsoft Sentinel, the company’s SIEM, has been integrated into the Microsoft Defender XDR portal. While Microsoft has deeply integrated incident management only between the two technologies at this point, all core Sentinel capabilities are available within the Defender XDR portal. There are no changes to the licensing of Sentinel or the services that comprise Microsoft Defender XDR.

What Changed in Microsoft Sentinel?

With this change, almost all Microsoft Sentinel functionality can be accessed within the Defender XDR portal. Microsoft describes this as “unified SIEM and XDR,” but full unification between Sentinel and Defender XDR is incomplete.