Microsoft 365 Defender integration with Microsoft Sentinel

Note

Want to experience Microsoft 365 Defender? Learn more about how you can evaluate and pilot Microsoft 365 Defender.

Applies to:

• Microsoft 365 Defender

The Microsoft 365 Defender connector for Microsoft Sentinel sends all Microsoft 365 Defender incidents and alerts information to Microsoft Sentinel and keeps the incidents synchronized.

Once you add the connector, Microsoft 365 Defender incidents—which include all associated alerts, entities, and relevant information received from Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, and Microsoft Defender for Cloud Apps—are streamed to Microsoft Sentinel as security information and event management (SIEM) data, providing you with context to perform triage and incident response with Microsoft Sentinel.

Once in Microsoft Sentinel, incidents remain bi-directionally synchronized with Microsoft 365 Defender, allowing you to take advantage of the benefits of both the Microsoft 365 Defender portal and Microsoft Sentinel in the Azure portal for incident investigation and response.

Watch this short overview of Microsoft Sentinel integration with Microsoft 365 Defender (4 minutes).

Here's how it works.

Next steps

1. Get a deeper understanding of Microsoft 365 Defender integration with Microsoft Sentinel.
2. Connect data from Microsoft 365 Defender to Microsoft Sentinel.

See also

• Overview of incidents in Microsoft 365 Defender
• Investigate incidents with Microsoft Sentinel