Reimagining the SOC for the agentic era in Microsoft Defender

Microsoft put ISOC in Defender on September 23, 2026

Microsoft opened a public preview of Integrated Security Operations Center, or ISOC, inside Microsoft Defender on September 23, 2026. It is Microsoft’s pitch for bringing SIEM and threat protection into one place, with Microsoft Defender XDR, threat intelligence, automation, and AI all living in the Defender portal.

For a small or mid-sized company, that sounds good because it cuts down on tool sprawl. We like that part. We also think the hype should be kept in check. This is a preview, not a finished platform, and preview software is where the sharp edges show up.

Who can actually use it

ISOC is only available right now to eligible Microsoft Defender Suite, Microsoft 365 E5, and Microsoft 365 E7 customers who do not already have an active Microsoft Sentinel workspace. If you already run Sentinel in production, Microsoft says to keep using that experience for now and not disconnect it just to qualify for the preview.

That matters. A lot of 30 to 300 person firms do not have E5 or E7, and plenty of them are on Business Premium or some mix of licenses that will not get them in the door. So this is not a universal Defender upgrade. It is a gated feature for a specific licensing group.

What changes for a 30 person company

If a company already lives in Microsoft 365 and Defender, ISOC could reduce the number of places an IT team has to check during an incident. Microsoft says there are more than 500 connectors for outside sources, so it is not limited to Microsoft-only data. That is useful if you are pulling in firewall logs, identity data, or another security product.

Still, this does not remove the real work. You need a dedicated ISOC workspace, and that workspace has to be linked to an Azure subscription. That means setup, permissions, and another cloud bill to watch. Nothing about that is magic.

If we were advising a lean IT team, we would not chase this just because it is new. We would only test it if the company already owns the required Microsoft license and has a clear reason to replace a messy mix of security tools or a half-used Sentinel setup.

The hidden costs are the point

Microsoft is not saying what ISOC will cost after preview. That is the biggest unanswered question. During the preview, Defender data retention is 30 days at no extra charge. That sounds generous, but 30 days is not enough for every business, especially if you have compliance needs, insurance requirements, or slow-moving investigations.

Also, the price question is not just the license. It is the Azure subscription, the work to stand up the workspace, and the time needed to tune alerts so your staff is not flooded with noise. We have seen too many tools sold as “one pane of glass” that turn into one more screen nobody trusts.

What we would do next

For most small businesses, we would treat ISOC as a promising preview and nothing more. If you already own Microsoft 365 E5 or E7, or Defender Suite, it is worth a controlled look. If you do not, this probably does not change your IT budget this quarter.

If you want to evaluate it, start with these questions.

• Do we already have the Microsoft license required to use it?
• Do we need a new Azure-backed workspace, and who will manage it?
• Will 30 days of included Defender retention be enough for us?
• Are we trying to replace Sentinel, or just reduce noise in Defender?

We would answer those before touching production. If you want help deciding whether ISOC fits your stack, IT911Now can help you sort through the licensing, the Azure setup, and whether this is a real improvement or just another dashboard.