AI is transforming the attacker’s operating model, accelerating threats to unprecedented speed and scale. Yet many security operations centers still depend on fragmented data, tools, intelligence, and workflows. Analysts spend valuable time rebuilding context and coordinating action across systems, while the economics of operating the SOC become increasingly difficult to sustain. Security operations need a new operating model, one that brings protection and operations together and gives people and agents the shared context they need to defend at scale.
On September 23, 2026, Microsoft announced the public preview of Integrated Security Operations Center (ISOC) in Microsoft Defender. The ISOC benefit enables eligible Microsoft Defender Suite, Microsoft 365 E5 and E7 customers to unlock more value from their existing investments by bringing XDR, SIEM, threat intelligence, automation, and AI together in Microsoft Defender.
A new foundation for security operations
The ISOC benefit brings protection and operations together in Microsoft Defender, helping eligible customers get more from their Microsoft investments and build the foundation for agentic security.
Customers benefit from:
- Native threat protection: Microsoft Defender provides threat protection solutions across identities, endpoints, SaaS apps, email and collaboration tools, and cloud workloads.
- Integrated security operations: SIEM capabilities are now available out-of-the-box in Microsoft Defender, giving eligible customers access to security operations capabilities without requiring a traditional SIEM deployment.
- Built-in retention: Retention for eligible customers will extend from 30 to 90 days across all Microsoft Defender data, Azure Activity, and Office 365 Activity, starting November 15, 2026.
- Expand visibility: Starting October 1, eligible customers can expand visibility with more than 500 connectors, using a $2.40 per GB pay-as-you-go ingestion meter. Regional pricing and other terms may vary.
- Built for future: Bring signals, context, and workflows together in one integrated experience, establishing the foundation for agentic AI security that helps accelerate investigation and response, and improve security outcomes.
Start with Microsoft Defender data. Expand when you need to.
ISOC builds on the security data already available across Microsoft Defender and other select Microsoft sources, providing a rich, Microsoft-native foundation for integrated security operations. Supported Microsoft Defender log sources are automatically available without separate ingestion requirements. Eligible customers receive 30 days of included Microsoft Defender data retention in public preview, extending to 90 days starting November 15, 2026.
Data sources covered by this new benefit include:
- Microsoft Defender for Endpoint
- Microsoft Defender for Office 365
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Cloud
- Microsoft Entra Identity Protection logs
- Azure Activity and audit logs, via connector
- Office 365 Activity and audit logs, via connector
Now in Public Preview
Starting today, eligible customers will begin seeing new security operations capabilities roll out in public preview, directly within the Microsoft Defender portal, with no additional configuration. An ISOC workspace is required for broader data ingestion and workspace-dependent capabilities.
Out of the box capabilities include:
- Case management – The new Cases experience will help analysts accelerate investigations, streamline response, and improve cross-team coordination. The new Cases experience brings incidents, collaboration, task assignment, automation, AI-powered summaries, and governance into a shared workspace, enabling security teams to manage the entire incident lifecycle in one place. Read blog to learn more.
- Workbooks – Gain real-time visibility into your security operations with custom dashboards. Monitor threats, track trends, measure outcomes, and report on key performance indicators across analysts, SOC managers, and executives.
- Playbook generation in natural language – Use natural language to create and orchestrate automation workflows, helping teams move faster and reduce manual effort.
An ISOC workspace is required for broader data ingestion and workspace-dependent capabilities like UEBA, Content Hub connectors for additional data ingestion, repositories (CI/CD), and threat intelligence.
Figure 2: Create a workspace to unlock more capabilities.Additional security operations capabilities will be added to the ISOC benefit over time as they become available, giving organizations a simple path to start with what is built into Microsoft Defender and expand as their security needs evolve.
Frequently asked questions
1. Is ISOC a new Microsoft security product?
ISOC is not a new standalone product. It is a benefit that expands the value of your existing investments in Microsoft Defender Suite, Microsoft 365 E5 and E7 investments by bringing security operations capabilities from our SIEM solution, Microsoft Sentinel, directly into Microsoft Defender.
2. Is there a minimum seat requirement?
No. There is no minimum seat threshold for eligible licenses. Standard product terms apply.
3. What are the prerequisites to get started with ISOC?
Customers need an active, eligible Microsoft Defender Suite, Microsoft 365 E5 or E7 license. An Azure subscription is required to create an ISOC workspace and use workspace-dependent capabilities.
4. What is included in the ISOC benefit in public preview?
Starting September 23, eligible Microsoft 365 E5 and E7 customers without an active Sentinel workspace will receive:
- 30 days of included Microsoft Defender data retention, with 90 days planned for November 15.
- Out-of-the-box security operations capabilities including Case Management, Workbooks, and playbook generation in natural language.
- Additional Microsoft and non-Microsoft data ingestion via 500 connectors in Content Hub, UEBA, Repositories (CI/CD) and threat intelligence (requires an ISOC workspace).
5. When can I use the $2.40/GB PAYG ingestion meter?
Starting October 1, 2026, eligible customers can use the $2.40 per GB meter to ingest non-Microsoft data through more than 500 connectors. Regional pricing and other terms may vary.
6. What should customers who already use Microsoft Sentinel do?
There is no change for customers currently using Microsoft Sentinel. The current Microsoft Sentinel offering will continue to exist as is. Existing Microsoft Sentinel customers will have the choice to move to ISOC starting November 15, 2026, if they meet the relevant licensing eligibility criteria.
Get started with ISOC in Microsoft Defender
Start with the capabilities available in Microsoft Defender, then create an ISOC workspace when your team needs broader data and workspace-dependent capabilities.
- Announcement blog: https://aka.ms/ISOCannouncement
- Learn more about ISOC in Microsoft Defender: https://aka.ms/ISOCDefender
- Get started with Case management: https://aka.ms/caseindefender
- Start using the security operations capabilities in Microsoft Defender: Documentation
Microsoft