Blog / Threat detection and response
Defender XDR vs standalone Sentinel: when to use each.
Microsoft unified the security portal in 2024, so Defender XDR and Sentinel now run in the same console. Superficially they look like one product. They are not. Defender XDR is the built-in Microsoft-native XDR. Sentinel is a SIEM that can ingest anything. Which one to run and when to add the other depends on your log-source variety and your log-volume budget.
What Defender XDR covers on its own
Defender XDR includes four native Microsoft signal sources that correlate into single incidents without needing Sentinel:
- Defender for Endpoint (device signals)
- Defender for Identity (on-prem AD signals via sensors)
- Defender for Office 365 (email and Teams collaboration signals)
- Defender for Cloud Apps (SaaS signals and shadow-IT visibility)
All four cross-correlate. A user reports a phishing email; Defender for Office 365 flags it; Defender for Endpoint sees the attempted execution on the user’s laptop; Defender for Identity sees the compromised credential try to move laterally; XDR ties all three into one incident with automated remediation.
No Sentinel required. No log ingestion cost. Available with Microsoft 365 E5 or standalone Defender licences.
When Defender alone is enough
- Environment is Microsoft-centric: most workloads run on M365, Azure and Windows.
- Log retention needs stay within Defender defaults (30 to 180 days depending on data type).
- Compliance regime does not mandate long-term (1-year or 7-year) log retention beyond what M365 provides.
- Team does not have KQL depth to maintain a large Sentinel workspace.
When to add Sentinel
- Non-Microsoft log sources need ingesting: AWS, GCP, Palo Alto firewalls, third-party SaaS.
- Regulator requires longer retention than Defender provides.
- Custom detections needed via KQL, beyond what Defender’s built-in analytics catch.
- SOAR playbooks needed for orchestrated response across systems Defender does not touch.
- Hunt team wants scheduled queries and jupyter-style investigation notebooks.
The cost model as of 2026
Sentinel pricing is per GB ingested per day. Two changes have shifted the math significantly since 2023:
- Defender data free in Sentinel. Microsoft-native Defender data ingested into Sentinel is free of charge (with reasonable-use limits). This makes the ”use Sentinel for everything” model much more affordable than it was.
- Auxiliary logs and basic logs tiers. Cheaper log tiers for verbose but low-value data (Windows Security event logs, verbose DNS logs) that you want to keep but rarely query.
The result: for a Microsoft-heavy shop, adding Sentinel is now typically 20 to 40 percent cheaper than the same setup would have been in 2023. Non-Microsoft ingestion still costs the standard tier rate.
The recommendation matrix
| Environment | Compliance retention need | Recommendation |
|---|---|---|
| 100% Microsoft, small team | Under 6 months | Defender XDR only |
| Microsoft-heavy, one or two AWS workloads | Under 12 months | Defender + Sentinel for AWS logs only |
| Mixed Microsoft + AWS/GCP | 1-3 years | Defender + Sentinel for all non-MS logs, MS logs stay in Defender |
| Regulated (finance, healthcare, gov) | 7 years plus | Defender + Sentinel with cold storage tier for long-term retention |
Related