Sources and documentation

Integrated security operations is in preview for eligible customers. These pages describe who qualifies and what it includes.

• Microsoft ISOC page and FAQ↗ (opens in a new tab)microsoft.com
• ISOC overview on Microsoft Learn↗ (opens in a new tab)learn.microsoft.com
• Microsoft subscription suites licensing guidance↗ (opens in a new tab)microsoft.com
• Project Perception overview↗ (opens in a new tab)learn.microsoft.com

The 89 sources the license model and product details rely on. Links to a source from older versions of this site land on the matching entry.

• Advanced hunting in Microsoft Defender (opens in a new tab)learn.microsoft.com
• Advanced hunting overview (opens in a new tab)learn.microsoft.com
• Agent 365 premium licensing and prerequisites (opens in a new tab)microsoft.com
• Agents in Microsoft Security Copilot (opens in a new tab)learn.microsoft.com
• Azure Monitor billed record size (opens in a new tab)learn.microsoft.com
• Cloud and AI Security Engineer Associate certification (opens in a new tab)learn.microsoft.com
• Cloud App Discovery and Defender for Cloud Apps editions (opens in a new tab)learn.microsoft.com
• Cloud portal paid-plan and cloud limitations (opens in a new tab)learn.microsoft.com
• Configure Insider Risk Management (opens in a new tab)learn.microsoft.com
• Configure Intune security baselines (opens in a new tab)learn.microsoft.com
• Connect Microsoft Sentinel to Microsoft Defender (opens in a new tab)learn.microsoft.com
• Connector scope of the ISOC Content hub preview (opens in a new tab)learn.microsoft.com
• Copilot workbook capacity and supported data (opens in a new tab)learn.microsoft.com
• Create custom Sentinel MCP tools (opens in a new tab)learn.microsoft.com
• Current enterprise and frontline subscription suites (opens in a new tab)microsoft.com
• Current Perception playbook triggers (opens in a new tab)learn.microsoft.com
• Custom detection data scope, roles and actions (opens in a new tab)learn.microsoft.com
• Custom detections from advanced hunting queries (opens in a new tab)learn.microsoft.com
• Cybersecurity Architect Expert certification (opens in a new tab)learn.microsoft.com
• Data lifecycle management (opens in a new tab)learn.microsoft.com
• Defender case management and workspace boundaries (opens in a new tab)learn.microsoft.com
• Defender for Cloud feature availability by portal (opens in a new tab)learn.microsoft.com
• Defender for Cloud portal expansion and setup (opens in a new tab)learn.microsoft.com
• Defender for Cloud posture and workload plans (opens in a new tab)learn.microsoft.com
• Defender for Identity supported systems and deployment (opens in a new tab)learn.microsoft.com
• Defender for Office 365 service description (opens in a new tab)learn.microsoft.com
• Defender for Servers Plan 2 data ingestion benefit (opens in a new tab)learn.microsoft.com
• Defender product licensing and editions (opens in a new tab)learn.microsoft.com
• Defender XDR prerequisites (opens in a new tab)learn.microsoft.com
• Eligible Microsoft-data ingestion benefit (opens in a new tab)azure.microsoft.com
• Entra ID and Entra Suite licensing (opens in a new tab)learn.microsoft.com
• Estimate volume from a monitored sample (opens in a new tab)learn.microsoft.com
• Exchange Online service description (opens in a new tab)learn.microsoft.com
• Existing native Defender for Cloud alert integration (opens in a new tab)learn.microsoft.com
• Foundational and Defender CSPM (opens in a new tab)learn.microsoft.com
• Frontline app and service rights (opens in a new tab)learn.microsoft.com
• Generate, test and activate ISOC playbooks (opens in a new tab)learn.microsoft.com
• Get started with Microsoft Security Copilot (opens in a new tab)learn.microsoft.com
• Identity and Access Administrator Associate certification (opens in a new tab)learn.microsoft.com
• Intune plans and capability rollout (opens in a new tab)microsoft.com
• Investigate data loss alerts in Microsoft Defender (opens in a new tab)learn.microsoft.com
• ISOC native data, billing and preview retention (opens in a new tab)learn.microsoft.com
• ISOC preview eligibility and workspace requirements (opens in a new tab)learn.microsoft.com
• ISOC preview enhanced and standard automation rules (opens in a new tab)learn.microsoft.com
• ISOC preview workbooks and permissions (opens in a new tab)learn.microsoft.com
• ISOC workspace prerequisites and permissions (opens in a new tab)learn.microsoft.com
• ISOC workspace repositories and CI/CD (opens in a new tab)learn.microsoft.com
• Loop access and storage requirements (opens in a new tab)support.microsoft.com
• Measure billable Log Analytics usage (opens in a new tab)learn.microsoft.com
• Microsoft 365 Apps for enterprise (opens in a new tab)microsoft.com
• Microsoft 365 Copilot Chat requirements (opens in a new tab)learn.microsoft.com
• Microsoft 365 E3, E5 and E7 licensing overview (opens in a new tab)learn.microsoft.com
• Microsoft 365 product terms (opens in a new tab)microsoft.com
• Microsoft Defender unified RBAC (opens in a new tab)learn.microsoft.com
• Microsoft guided Sentinel cost estimator (opens in a new tab)microsoft.com
• Microsoft ISOC commercial eligibility and data-benefit FAQ (opens in a new tab)microsoft.com
• Microsoft Planner service description (opens in a new tab)learn.microsoft.com
• Microsoft Purview Audit editions (opens in a new tab)learn.microsoft.com
• Microsoft Security Adoption Framework (opens in a new tab)learn.microsoft.com
• Microsoft Sentinel data connectors (opens in a new tab)learn.microsoft.com
• Office 365 plan options (opens in a new tab)learn.microsoft.com
• OneDrive service description (opens in a new tab)learn.microsoft.com
• Outlook application licensing (opens in a new tab)learn.microsoft.com
• Paid UEBA for native Defender and ingested data (opens in a new tab)learn.microsoft.com
• Perception sessions and supervision (opens in a new tab)learn.microsoft.com
• Plan Communication Compliance (opens in a new tab)learn.microsoft.com
• Power Platform seeded and premium licensing (opens in a new tab)learn.microsoft.com
• Project Perception agent and workflow concepts (opens in a new tab)learn.microsoft.com
• Project Perception limited public preview (opens in a new tab)learn.microsoft.com
• Project Perception setup and permissions (opens in a new tab)learn.microsoft.com
• Published Defender for Cloud pricing (opens in a new tab)azure.microsoft.com
• Published Sentinel pricing and commitment tiers (opens in a new tab)azure.microsoft.com
• Purview eDiscovery permissions (opens in a new tab)learn.microsoft.com
• Purview information protection and DLP licensing (opens in a new tab)learn.microsoft.com
• Security Copilot capacity and compute units (opens in a new tab)learn.microsoft.com
• Security Copilot inclusion and tenant rollout (opens in a new tab)learn.microsoft.com
• Security Operations Analyst Associate certification (opens in a new tab)learn.microsoft.com
• Sentinel analytics and lake data tiers (opens in a new tab)learn.microsoft.com
• Sentinel automation rules and playbooks (opens in a new tab)learn.microsoft.com
• Sentinel data lake architecture and analysis (opens in a new tab)learn.microsoft.com
• Sentinel data lake notebooks (opens in a new tab)learn.microsoft.com
• Sentinel data lake query prerequisites, jobs and billing (opens in a new tab)learn.microsoft.com
• SharePoint Online service description (opens in a new tab)learn.microsoft.com
• Standalone SharePoint and OneDrive plan lifecycle (opens in a new tab)learn.microsoft.com
• Teams Phone licensing and calling requirements (opens in a new tab)learn.microsoft.com
• Track a Microsoft Azure Consumption Commitment (opens in a new tab)learn.microsoft.com
• Understand Microsoft Sentinel billing (opens in a new tab)learn.microsoft.com
• Visualize Sentinel data with workbooks (opens in a new tab)learn.microsoft.com
• Windows Enterprise deployment licensing (opens in a new tab)learn.microsoft.com

Microsoft documentation for each of the 45 products on the wheel, grouped by category in the order the wheel shows them, clockwise from the top.