Who does what
Provider
- Monitor and manage supported platforms
- Investigate alerts and tune detection content
- Contain within agreed response rules
Your team
- Maintain platform licenses and data sources
- Define approvals and rules of engagement
- Own business remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Microsoft teams needing Sentinel and Defender monitoring and analyst capacity
Supported stack
The Microsoft offer centers on Sentinel, Defender XDR and Defender for Cloud. Confirm connected sources and active response scope in the quote.
Response rules
Containment depends on supported tools, subscribed scope and agreed rules of engagement. Recovery and business remediation remain buyer-owned.
Additional services
Assessments, deployment and continuous optimization are distinct offers. Confirm their inclusion and how incident response extends beyond routine MDR.
Full service analysis
BlueVoyant MDR for Microsoft monitors Sentinel and Defender, investigates alerts and operates response workflows under agreed rules of engagement. You retain the Microsoft licenses and data sources, set response authority and complete business remediation and recovery.
- Your team owns
- Owning the Microsoft tenant, licenses and sources used by the service
- Maintaining endpoint, identity, cloud and log-source coverage outside the managed scope
- Defining rules of engagement and approving sensitive response actions
- Handling business remediation, recovery, user communication and IT changes outside MDR tooling
- Confirming whether DFIR support, extra engineering, assessments or optimization work is included or separately quoted
Why co-managed SOC
BlueVoyant's Microsoft MDR and Manage & Monitor pages describe 24/7 monitoring, investigation, response and Microsoft security management around customer-owned tooling. Buyers still own the tenant, licensing, data quality, response policy and business remediation.
Containment boundary
Current Microsoft offer pages say BlueVoyant stops threats, but do not specify every containment action or approval rule. Confirm tool access, pre-approved actions and customer sign-off in a response matrix.
Stack fit
This profile covers MDR for Microsoft. Confirm which Sentinel, Defender, cloud and third-party sources the SOC will monitor, investigate and act upon in your contract.
AI boundary
BlueVoyant says its AI agents summarize incidents, map cases to playbooks, trigger automated response and generate playbooks under analyst control. Its public Microsoft offer does not specify which agents or actions are enabled for every customer; require these in the rules of engagement.
Pricing & contract
- Billing
- Custom
Request a scoped Microsoft MDR quote separating service work, Microsoft licenses, Sentinel ingestion and retention, onboarding and response extras. Public reseller schedules cover different deployments and are not a universal rate for this Microsoft service.
Tradeoffs & buying questions
Strengths
-
Operates around the buyer's Microsoft stack
Operates detection and investigation around the buyer's Microsoft stack.
-
Managed detection content and platform monitoring
Adds managed detection content and recurring platform monitoring.
-
UK route with Leeds and Cork SOC monitoring
Offers Microsoft MDR monitoring from Leeds and Cork for its UK service route.
Considerations
-
Coverage follows subscribed products and connected sources
Purchased Microsoft products and connected sources define the managed coverage.
-
Buyer-owned licenses and data-source quality
Buyers retain Microsoft licensing and data-source quality.
-
Additional engineering and DFIR need explicit scope
Assessments, deployment, optimization and wider DFIR need explicit scope.
Ask before buying
- Which response actions are pre-approved, and which wait for our consent?
- Does our quote include deployment, platform engineering, DFIR and third-party EDR coverage?
- How do endpoints, sources, Sentinel ingestion and contract term change pricing?
Integrations
Platform / SIEM
- Microsoft Sentinel
Endpoint
- Microsoft Defender for Endpoint
- Microsoft Defender XDR
Cloud
- Microsoft Azure
Other integrations
- Microsoft Defender for Cloud
- Microsoft 365
Common questions
Does BlueVoyant MDR for Microsoft run the SOC for the buyer?
This profile classifies it as Co-manage the SOC. BlueVoyant monitors, investigates and operates contracted Microsoft workflows, while the buyer keeps the tenant, licenses, data sources, response policy and remediation.
Can BlueVoyant MDR for Microsoft contain threats?
BlueVoyant says it stops threats through its Microsoft MDR service. Confirm the exact actions, tools and pre-approval rules before treating containment as delegated.
Is BlueVoyant MDR for Microsoft pricing public?
Request a Microsoft-specific quote that separates the service from Microsoft licensing, Sentinel ingestion, onboarding and response extras. Public reseller examples and Splunk marketplace prices describe different deployments.
Company details
- SOC regions
- Europe / UK