Three things CISOs
should know about ISOC.

Your existing investment is the starting point.

Microsoft 365 is more than its security products. People work in Outlook, Teams, SharePoint, OneDrive, Word and Excel. Security protects that work; compliance governs the information it creates.

Microsoft 365 E5 brings advanced protections across email, endpoints, identity and SaaS, and Purview data security: its data loss, insider risk and audit signals can reach the same SOC once each is set up. E7 adds further capabilities. Office 365 E5, Microsoft 365 E5 and a Defender security add-on are different purchases. A label that says “E5” is not enough to establish your rights.

Keep useful third-party tools. A customer using CrowdStrike for EDR can still use licensed Microsoft identity, email and SaaS protections. Connecting third-party events is a separate data and configuration decision.

Ask your team Which of our licensed protections are actually configured and feeding investigations?

The operating model matters more than the portal.

Defender and Sentinel already integrate. The useful change is how much evidence, context and response an analyst can use in one investigation.

Native Defender evidence, external events in a Sentinel workspace and separately licensed cloud protection play different roles. Defender for Cloud posture management and workload protection are also distinct. A unified experience does not make all plans included or move every Azure management task.

Workbooks explain what is happening. Automation acts on rules. Developer tools extend the workflow. Each needs the right data and permissions. Creating a workflow is different from testing, activating and operating it.

Agents need this foundation too: trustworthy context, scoped access and observable actions. An agent entitlement does not remove those requirements.

Ask your team Can we demonstrate one investigation from evidence to an authorized action?

Price the route, not just the gigabyte.

Native access and paid ingestion are different. Identify which evidence needs to be copied, which retention period is useful, and which workloads need compute. A lower ingestion charge can create budget room, but it is not a forecast of total savings.

Compare your current effective rates with any applicable offer under review. Include retention, storage, compute, agent capacity and operations in the wider business case. Do not assume a new offer changes the terms of an existing Sentinel deployment.

If you have a Microsoft Azure Consumption Commitment, check which meters count toward it. MACC fulfillment and a price discount are different things. Ask your account team for written offer eligibility and any negotiated terms.

Keep Defender for Cloud as its own cost line. Use the published plan prices and update your model if the published terms change.

Ask your team Which costs change, which remain, and what evidence supports the estimate?