Downloads and checklists

Architecture

• PDFArchitecture overviewAn illustrative Microsoft 365 E5 view on two printable pages.PDF · 1.1 MBDownload ↓
• PNGArchitecture imageThe architecture view as an image for slides and chat.PNG · 1.4 MBDownload ↓
• SVGArchitecture vectorA scalable version for design tools and large prints.SVG · 61 KBDownload ↓

Planning

• PDFReadiness checklistThe questions below, plus the three Purview signal conditions, formatted for a planning meeting.PDF · 4 KBDownload ↓
• PDFYesterday to todayA one page comparison that starts from where your environment is now.PDF · 3 KBDownload ↓

Work through these before you change licenses, connect new data or switch on automation.

• Record the exact license SKU, cloud and tenant rollout status.
• Check which endpoint, identity, email and cloud app protections are deployed.
• Confirm ISOC preview eligibility; keep existing Sentinel workspaces and production protections connected.
• Select the external sources and events the investigation actually needs.
• Verify workspace, connector, source permissions and data retention requirements.
• Separate native data access, ingestion, storage, compute and agent capacity.
• Confirm action ownership, permissions and how results will be checked.
• Verify current public documentation and tenant availability before changing production.

• Three things CISOs should know about ISOCA short field note on investment, operating model and cost.
• Sources and documentationThe Microsoft pages behind every claim on this site.
• About this projectWho built IntegratedSOC and why.