Managed Microsoft security services: scope, models and costs
Group COO & CISO
Operational excellence, governance, and information security. Aligns technology, risk, and business outcomes in complex IT environments
Managed Microsoft security services are an outsourced team that configures, monitors and responds through the security tools you already license from Microsoft: Defender XDR, Microsoft Sentinel, Entra ID, Intune, Purview and Defender for Cloud. The provider watches alerts 24/7, investigates and contains incidents, hardens your tenant and reports on risk, so licences turn into working protection.
Key takeaways
- Most organisations already pay for strong Microsoft security tooling; the gap is usually configuration, tuning and someone watching the alerts at night.
- A managed service typically covers four layers: identity (Entra ID), endpoints and email (Defender XDR, Intune), cloud workloads (Defender for Cloud) and SIEM (Microsoft Sentinel).
- Microsoft sells its own MDR service, Defender Experts MDR; partners add tenant hardening, device management, compliance evidence and local-language response.
- Microsoft Sentinel moves fully to the Defender portal: after 31 March 2027 it will no longer be supported in the Azure portal, so plan the switch now.
- Write response times, containment rights and data residency into the contract before signing.
What do managed Microsoft security services include?
The service wraps people and process around Microsoft's security stack. The tools detect; the provider decides what an alert means and acts on it. A typical scope looks like this.
| Layer | Microsoft product | What the provider does |
|---|---|---|
| Identity | Microsoft Entra ID, Conditional Access, ID Protection | MFA rollout, Conditional Access policies, privileged role reviews, risky sign-in response |
| Endpoints and email | Defender for Endpoint, Defender for Office 365, Intune | Onboarding devices, attack surface reduction rules, phishing triage, isolating compromised devices, device compliance policies |
| Cloud workloads | Microsoft Defender for Cloud | Posture recommendations, workload protection for servers, databases and storage on Azure, AWS and Google Cloud |
| SIEM and SOAR | Microsoft Sentinel | Data connectors, analytics rules, playbooks, threat hunting, log retention design |
| Data protection | Microsoft Purview | Sensitivity labels, data loss prevention policies, audit log retention for investigations |
Microsoft Defender XDR is the hub. It coordinates detection, prevention, investigation and response across endpoints, identities, email and applications, and groups related alerts into incidents. A managed team works mostly in that incident queue.
Why buy it as a managed service instead of running it yourself?
Because the hard part is not buying the licence, it is the daily work after it. Three gaps come up again and again in Microsoft 365 tenants.
- Tools left on default settings. Defender features are licensed but not switched on, Conditional Access has exceptions nobody remembers, and Sentinel collects logs without useful analytics rules.
- No one watching out of hours. Attacks on mailboxes and identities often start at night or at weekends. An alert that waits until Monday is a much bigger incident by then.
- Too few specialists. Running a 24/7 rota takes several trained analysts. Most mid-sized companies have one or two people who cover security next to other IT work.
A managed provider fills those gaps with a shared security operations centre (SOC), runbooks that are tested across many tenants, and engineers who configure the stack once and then keep it tuned.
Which service models are available?
There are three common ways to buy managed security around Microsoft tools. They differ in who does the work and how far the scope reaches.
| Model | Who runs it | Scope | Good fit when |
|---|---|---|---|
| Microsoft Defender Experts MDR | Microsoft's own analysts | Detection and response for Defender workloads (Plan 1), plus selected non-Microsoft data in Sentinel (Plan 2) | You want Microsoft-operated MDR and have staff to handle configuration and follow-up |
| Partner managed service (MSSP or MXDR) | A Microsoft partner's SOC | Monitoring and response plus tenant hardening, Intune, compliance reporting and non-Microsoft sources | You want one team accountable for both configuration and response |
| Co-managed | Your team in business hours, the provider out of hours and for escalations | Shared, set by a RACI | You have an internal security team that cannot cover nights and weekends |
According to Microsoft, Defender Experts MDR has Microsoft analysts manage your incident queue around the clock, triage and investigate incidents, and either act or guide your team through the response. It is sold separately from the Defender products. Partners often run alongside it or replace it, depending on how much hands-on configuration and local support you need.
How does onboarding work?
A structured onboarding usually runs in four steps.
- Assessment. Review licences, Secure Score, Conditional Access, admin roles, device coverage and existing log sources. Agree on which incidents the provider may contain without asking first.
- Hardening. Close the high-risk gaps: MFA for all users, blocking legacy authentication, removing standing global admin rights, enabling Defender for Endpoint on every device and turning on mailbox auditing.
- Detection build. Connect data to Microsoft Sentinel, enable analytics rules that match your environment, and build playbooks for common responses such as disabling a compromised account.
- Operations. 24/7 monitoring starts, with a monthly report on incidents, posture changes and recommended next steps.
Conditional Access deserves extra time in step 2. It is the policy engine in Entra ID: if-then rules that, for example, require MFA before anyone reaches Microsoft 365. A single forgotten exception, such as an old service account excluded from MFA, can undo the rest of the setup.
What changes with Microsoft Sentinel in the Defender portal?
Microsoft is moving Sentinel into the unified Defender portal. Per the Microsoft Sentinel overview, Sentinel is generally available there, including for customers without Defender XDR or an E5 licence, and after 31 March 2027 it will no longer be supported in the Azure portal. If your provider still works only in the Azure portal, ask for its transition plan.
How do managed services support GDPR and NIS2?
They give you the detection speed and the evidence that both laws expect. Neither law names Microsoft tools, but both set deadlines that are hard to meet without continuous monitoring.
- GDPR. A personal data breach must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (GDPR, Article 33).
- NIS2. Essential and important entities must send an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month (Directive (EU) 2022/2555, Article 23).
A managed SOC helps by detecting the incident early, keeping a timeline of every action, and preserving logs in Sentinel and Purview for the investigation. Ask your provider to show a sample incident report before you sign; it should be usable as the basis of a regulatory notification. Read more in our NIS2 directive overview.
What does it cost?
Pricing is usually per user or per device per month for the managed service, on top of your Microsoft licences. Microsoft Sentinel adds consumption costs, because it bills on the volume of data ingested and analysed.
Three things drive the total more than the headline price:
- Log volume. Firewall and proxy logs can dwarf Microsoft 365 data. A good provider sends only the data that supports detections to the analytics tier and archives the rest more cheaply.
- Response scope. Monitoring only is cheaper than monitoring plus containment plus recovery. Know which one you are buying.
- Included engineering. Policy changes, Intune work and new data connectors are either in the fee or billed hourly. Ask for a list.
How to choose a provider: a checklist
- Does the provider work in your tenant with delegated, least-privilege access (for example, Microsoft's granular delegated admin privileges) rather than shared global admin accounts?
- Which response times does the SLA commit to per priority, and are they measured from alert or from ticket creation?
- Which actions may the provider take without calling you first: isolate a device, disable a user, revoke sessions, block a sender?
- Where are analysts located, where is log data stored, and does that match your GDPR and data residency requirements?
- Does the service cover non-Microsoft sources you care about, such as firewalls, AWS accounts or OT networks?
- What does the monthly report contain, and will it support audits for ISO 27001 or NIS2?
- How do you exit: who owns the analytics rules, playbooks and documentation?
How Opsio helps
Opsio runs a 24/7 security operations centre and manages Microsoft 365, Intune and Azure for customers in the Nordics and India. Our managed Microsoft Sentinel service covers data connectors, analytics rules, playbooks and threat hunting, and our managed detection and response team handles triage and containment. P1 incidents are acknowledged within 15 minutes around the clock, P2 within 30 minutes and P3 within 4 business hours.
On the compliance side, Opsio is the end-to-end NIS2 partner for Löfbergs, the Karlstad coffee roaster. The work ran in four phases: a gap analysis against NIS2 and the Swedish Cybersecurity Act, a prioritised roadmap, implementation of controls such as risk management, incident handling, access control, logging and monitoring, and ongoing compliance support. Read the Löfbergs NIS2 case.
Frequently asked questions
What is the difference between an MSSP and MXDR for Microsoft?
An MSSP (managed security service provider) traditionally monitors alerts and escalates them. MXDR (managed extended detection and response) also investigates and contains threats inside the Microsoft stack, for example by isolating a device or disabling an account. Many providers now offer both under one contract.
Does Microsoft offer its own managed security service?
Yes. Microsoft Defender Experts MDR is Microsoft's managed detection and response service, sold in two plans. Plan 1 covers Defender workloads; Plan 2 adds selected non-Microsoft data collected in Microsoft Sentinel.
Do I need Microsoft 365 E5 for managed Microsoft security?
No, but the licence decides which tools the provider can use. Many services start with what you own, often Business Premium or E3 with add-ons, and recommend upgrades only where they close a specific risk. Microsoft Sentinel is billed separately on data volume.
Can a managed provider respond to incidents, or only alert us?
That depends on the contract. Agree in writing which actions the provider may take on its own, such as isolating devices or revoking sessions, and which need your approval. Without that, response waits for a phone call.
How long does onboarding take?
It depends on tenant size, device coverage and how many log sources you connect. Hardening identity and endpoints usually comes first, because it reduces risk before the full Sentinel detection build is finished.
Related reading: What Is the Microsoft Azure Service for Backups.
Related Articles
About the Author
Group COO & CISO
Fredrik is the Group Chief Operating Officer and Chief Information Security Officer at Opsio. He focuses on operational excellence, governance, and information security, working closely with delivery and leadership teams to align technology, risk, and business outcomes in complex IT environments. He leads Opsio's security practice including SOC services, penetration testing, and compliance frameworks.
Editorial standards: This article was written by a certified practitioner, named in the byline above. We revise it when the technology or regulation it covers changes; the dates above show the latest update. Opsio maintains editorial independence — we recommend solutions on technical merit, not commercial relationships.
