IntegratedSOC
Menu

Roles

Start from the question your role has to answer

Each role starts from one question and lights the products that help answer it.A license list is easier to act on when it starts from a job. Each role below has a first question, the products on the wheel that help answer it, one practical tip, and Microsoft resources to read or build with next.

Drawn on Microsoft 365 E5

The products these seven roles start from, in their places on the wheel. Open the wheel

CISO / security leader

Where should we invest next?

Lit: ISOC, Hunting, SIEM, Data security, Paid CSPM.Lit: connected sources into Sentinel; Information protection into ISOC. ISOC uses Incidents and hunting and Sentinel. Context only, with no route into ISOC here: Defender CSPM. Sentinel and Defender CSPM are separate Azure plans, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage. Marked with an asterisk, so reaching ISOC needs a setting, a preview or a workspace connector first: Information protection.

Look at these on the wheel

A practical first step

Choose one risk outcome. Assign an owner and a measure of success before adding another tool.

Before these signals reach ISOC

Read and build next

SOC analyst

How do I investigate across products?

Lit: ISOC, Hunting, Endpoint, ITDR, Email, CASB, SIEM.Lit: connected sources into Sentinel; Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud Apps into ISOC. ISOC uses Incidents and hunting and Sentinel. Sentinel is a separate Azure plan, drawn gold dashed. Incidents and hunting come with Defender XDR. Sentinel runs on its own workspace and usage.

Look at these on the wheel

A practical first step

Start with one incident. Confirm which tables and entities you can inspect, then follow the evidence across workloads.

Read and build next

Security engineer

What should I connect or automate?

Lit: ISOC, APIs, SOAR, Reports, SIEM, SOC AI.Lit: connected sources into Sentinel. ISOC uses Developer tools, Automation, Workbooks, Sentinel and Security Copilot. Sentinel is a separate Azure plan, drawn gold dashed. Sentinel runs on its own workspace and usage. Security Copilot runs on its own capacity.

Look at these on the wheel

A practical first step

Validate a saved query and its data scope before exposing it to an agent. Test automation with a narrow, reversible action.

Read and build next

Identity administrator

Who and what can act on this data?

Lit: ISOC, Zero Trust access, ITDR, Agent control, IAM.Lit: Defender for Identity and Entra ID into ISOC. Context only, with no route into ISOC here: Entra Suite and Agent 365.

Look at these on the wheel

A practical first step

Review both the operator’s permissions and the agent’s resource scopes. An assigned role does not establish access to every device group.

Read and build next

Cloud security engineer

How do cloud risks join the investigation?

Lit: ISOC, Free CSPM, Paid CSPM, Server CWPP, K8s CWPP, Storage CWPP, DB CWPP.Lit: Defender for Servers, Defender for Containers, Defender for Storage and Defender for Databases into ISOC. Context only, with no route into ISOC here: Foundational CSPM and Defender CSPM. Defender CSPM, Defender for Servers, Defender for Containers, Defender for Storage and Defender for Databases are separate Azure plans, drawn gold dashed.

Look at these on the wheel

A practical first step

Inventory your workloads, then choose the posture and protection plans each needs. Verify portal support and resource permissions separately.

Read and build next

Data protection lead

Which data risks reach the SOC?

Feeds ISOC: Data security, Insider risk, Audit log.Stays in Purview: Legal hold.Lit: Information protection, Insider Risk and Audit into ISOC. Context only, with no route into ISOC here: eDiscovery. Marked with an asterisk, so reaching ISOC needs a setting, a preview or a workspace connector first: Information protection, Insider Risk and Audit.

Look at these on the wheel

A practical first step

Start with one data loss policy. Check that its alerts reach the Defender incident queue, then who can open them: Purview permissions stay separate from Defender roles.

Before these signals reach ISOC

Read and build next

Microsoft 365 administrator

What protects the apps I run?

Lit: ISOC, Mailboxes, Intranet, Meetings, OS, Email, Endpoint.Lit: Defender for Office 365 and Defender for Endpoint into ISOC. Context only, with no route into ISOC here: Exchange, SharePoint, Teams and Windows.

Look at these on the wheel

A practical first step

Start with the workloads you run. Check which Defender protections are deployed for mail and devices: a license alone deploys nothing.

Read and build next

Limited public preview · invitation-only

Project Perception

Coordinated agents investigate threats, examine exposure and prioritize posture work in Microsoft Defender. Teams supervise sessions and approve actions when requested.

Red · Explore exposure
Find attack paths, excess permissions and exposed assets.
Blue · Investigate threats
Triage alerts, investigate incidents and develop detections.
Green · Prioritize posture
Rank posture issues and plan remediation using risk and context.

Requires preview access, Defender portal access, unified RBAC across Defender workloads, and configured agent identities and resource scopes. Choosing E5, E7 or ISOC here does not confirm access or pricing.

Microsoft's Project Perception page (opens in a new tab)