Forum Discussion

Matt2023's avatar
Matt2023
Copper Contributor
Nov 01, 2023

Microsoft 365 Defender into Sentinel

I've just started to look at onboarding devices into 365 Defender via the script provided and all works great. We do use an independent anti-virus product but I like the additional telemetry associat...
Microsoft Defender for Endpoint
Onboarding
SIEM
Matt2023's avatar
Matt2023
Copper Contributor

eliekarkafy 

 

Hi,

 

I did spot that but I just wanted to know that if we onboarded lots of devices into Microsoft 365 Defender for Endpoint would our sentinel costs spiral out of control.

 

Saying that I was just trying to get a bit more info on this and it looks like to use the Microsoft 365 Defender for Endpoint connector in Sentinel anyway you need to have an E5 licence.

 

We predominantly use E3's so I guess I can onboard away as the data shouldn't end up in Sentinel anyway if that's the case.

adiii's avatar
adiii
Brass Contributor
Nov 02, 2023

Hi Matt

Please check microsoft-sentinel Pricing here:
https://azure.microsoft.com/en-us/pricing/details/microsoft-sentinel/
Go to section "Microsoft Sentinel free data sources". That means for me also with your E3 license it should be working / should be free.
In the connecter page there is written:
License: M365 E5, M365 A5 or any other Microsoft 365 Defender eligible license.

There is also a volume-cap you can set to monitor your costs:
https://learn.microsoft.com/en-us/azure/sentinel/billing-monitor-costs

Regards,
Adii

Resources