Pick a license to see what it includes, and whether it builds the Integrated Security Operations Center (ISOC) wheel.
31 of 45 included, 5 with conditions.Builds the ISOC wheel.
This plan builds the ISOC wheel. Build it, then activate ISOC.
A license is an entitlement. It gives you rights to products, not a configured tenant.
31 of 45 included, 5 with conditions.Builds the ISOC wheel.
This plan builds the ISOC wheel. Build it, then activate ISOC.
Reading the map
A solid brick, or a solid face on the wheel, means the product is included with this plan.
A striped brick, or a face with a dotted inner edge, means it is included, with conditions to check.
A gold dashed edge, on a brick or a wheel face, means a separate Azure plan, bought on its own, not part of Microsoft 365.
A grey dashed outline on a brick, or a grey face on the wheel, means it is not included with this plan.
SIEM (Microsoft Sentinel), Defender CSPM and the Defender for Cloud workload plans are billed through Azure, so they show as separate purchases on every Microsoft 365 license.
Select a category name for its products and resources, or a product for details. With a keyboard, Left and Right move around a band, Up moves outward and Down moves toward ISOC. Escape steps back.
A license is an entitlement. It gives you rights to products, not a configured tenant.
Signals Defender, Entra and Purview signals light up.
ISOC One SOC in the Defender portal.
ISOC adds Cases, and the tools to work them.
Together Brought into the same place.
Ready ISOC: one SOC in Defender. Nothing is switched on in your tenant.
Go further
What happens after the license
The bricks and the wheel show what a license includes. These pages cover what happens next: who does the work, how an investigation runs, and what it costs.