Microsoft announced an Integrated Security Operations Center (ISOC) in Defender on September 23, 2026. The preview brings security information and event management (SIEM), extended detection and response (XDR), automation, and AI-assisted work into a shared Defender experience. Microsoft wants analysts and agents to have the same signals and context when they investigate and respond to threats.
For now, access is narrower than that vision might suggest. This phase is for eligible Microsoft Defender Suite and Microsoft 365 E5 or E7 customers without an active Microsoft Sentinel workspace. Some capabilities work without creating an ISOC workspace; others require one. Included retention applies to Defender data, while additional data may incur ingestion charges.
The preview does not offer a fully autonomous SOC. The practical question for security teams is which investigations and response workflows they can move into Defender now, and what it takes to run them.
ISOC Gives Analysts and Agents a Shared Starting Point
SIEM tools bring security data together for investigation, while XDR connects detections and response across protected systems. ISOC puts those functions closer together in the Defender portal, alongside threat intelligence, automation, and AI-assisted workflows.
Microsoft describes a continuous protection loop: signals inform investigations, and what defenders learn can feed protective action. That is the company’s intended operating model, not a measured outcome established by the preview announcement. A shared interface may reduce handoffs between tools, depending on the data a team can access and the actions its analysts can safely take.
The initial feature set is more concrete than the agentic framing. Eligible teams can start with case management, workbooks, natural-language playbook generation, and enhanced automation rules without first creating an ISOC workspace. These give analysts a way to organize work and build supported response workflows. They do not mean every SIEM function or data source is available by default.
An Active Sentinel Workspace Changes Eligibility
Microsoft’s ISOC preview eligibility guidance names three qualifying licenses: Microsoft Defender Suite, Microsoft 365 E5, and Microsoft 365 E7. During this phase, the organization must also lack an active Microsoft Sentinel workspace.
