Who does what
Provider
- Investigate Microsoft security alerts
- Deliver actionable incident tickets
- Provide case and service-status visibility
Your team
- Execute containment unless separately assigned
- Maintain Microsoft licenses and access
- Complete remediation and recovery
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Teams with Microsoft security licenses and staff able to act on investigated incidents
The Microsoft service scope
Uses the Microsoft security products you license and connect. Every listed product is not mandatory.
Guidance and emergency response
Investigated cases include response guidance. Emergency-response commitments depend on the selected plan.
Optional operating work
Hunting, engineering, service meetings and full platform management depend on the plan.
Full service analysis
NVISO Microsoft MXDR investigates Microsoft security alerts around the clock and sends actionable cases to your IT team. This profile covers alert handling and response guidance, with your team retaining containment and recovery unless the order assigns additional response work to NVISO.
- Your team owns
- Execute containment unless separately assigned
- Maintain Microsoft licenses and access
- Complete remediation and recovery
The Microsoft service scope
The marketplace offer can use Defender for Endpoint, Cloud, Cloud Apps, Identity and Office 365 alongside Sentinel. Not every license is required. The products you license and connect determine the alerts available to the service.
Guidance and emergency response
NVISO describes triaged incidents with actions and recommendations. CSIRT support is available, but the marketplace makes a 24/7 emergency-response SLA plan-dependent. Document execution authority and included support before assuming a containment handoff.
Optional operating work
The marketplace distinguishes base alert handling from plan-dependent threat hunting, detection engineering, service meetings and full Microsoft platform management. The broader NVISO service page combines these capabilities, so use the order to settle what is included.
Pricing & contract
- Billing
- Custom
Request a service quote tied to the connected Microsoft products and selected operating work. Itemize licenses, consumption, hunting, platform management and emergency response.
Tradeoffs & buying questions
Strengths
-
Builds on Microsoft licenses already in use
-
Connects investigated cases to the buyer’s ITSM workflow
-
Separates alert handling from additional operating services
Considerations
-
The base description leaves action execution with the buyer
-
Hunting and full platform management require plan checks
-
CSIRT availability is not proof of unlimited included incident response
Ask before buying
- Which Microsoft products and licenses are required for our coverage, and who manages the connectors and platform day to day?
- Which containment actions will NVISO execute, under whose approval, and what CSIRT hours and emergency SLA are included?
- Does the price include hunting, detection engineering, service meetings and Microsoft consumption, and what case-export rights do we retain?
Integrations
Platform / SIEM
- Microsoft Sentinel
Endpoint
- Microsoft Defender for Endpoint
Cloud
- Microsoft Azure
Other integrations
- Microsoft Defender for Identity
- Microsoft Defender for Office 365
- ITSM ticket integration
Common questions
Does this service require the full Microsoft security suite?
No. The marketplace says all listed licenses are not required. Agree which licensed products are connected and what incidents those sources let NVISO investigate.
Does every plan run the Microsoft platform for us?
No. Full platform management is plan-dependent. This profile covers the alert-handling service and identifies the additional work to specify in the order.