Who does what
Provider
- Operate covered Sentinel and Defender workflows
- Investigate with automation and Cyber Defenders
- Contain through approved Microsoft controls
Your team
- Maintain required Microsoft licenses and workspaces
- Connect logs and maintain escalation rules
- Handle IT remediation outside approved playbooks
Coverage
- Endpoints
- Cloud Workloads
- Identity & Access
- Network
- SaaS Applications
Details
Service scope
Best for Microsoft-first teams wanting Sentinel and Defender operations with Teams collaboration
Microsoft prerequisites
The service requires a Microsoft tenant, Sentinel, Log Analytics, Defender for Endpoint Plan 2, Entra ID Plan 2 access and a shared Teams channel. Required Defender deployment and server licensing enable containment.
Managed detections
Customer-created analytic rules and policies are outside ION service coverage. Additional log ingestion and custom connector work require agreed scoping.
Response and add-ons
Approved Microsoft actions can include host isolation, indicator blocking and Defender investigation or remediation. IoT, enhanced phishing, vulnerability and high-impact DFIR services have separate scopes.
Full service analysis
Ontinue ION MXDR co-manages security operations in the buyer's Microsoft Sentinel and Defender environment. After an alert, ION automation and AI investigate, Cyber Defenders review escalations and approved actions can contain threats, while the buyer keeps Microsoft licensing, source onboarding, response rules and IT remediation.
- Your team owns
- Buying and maintaining required Microsoft Sentinel, Log Analytics, Defender and Teams licensing
- Connecting and maintaining customer log sources, agents, tenants and workspaces
- Keeping escalation contacts, response rules and approval paths current
- Performing IT remediation or business-owner decisions outside approved playbooks
- Scoping paid consulting, IoT, phishing or vulnerability add-ons when the base MXDR service does not include them
Containment boundary
Public sources support active response and containment through Microsoft controls, including Defender for Endpoint deployment requirements and predetermined response actions. Buyers should not assume every containment action is automatic, because the service also relies on rules of engagement and customer escalation paths.
Microsoft dependency
Ontinue is intentionally Microsoft-focused. That is useful for buyers standardizing on Sentinel, Defender, Entra and Teams, but it is a weaker fit for teams that want a vendor-neutral MDR layer over CrowdStrike, SentinelOne, Splunk or a non-Microsoft SIEM as the primary control plane.
Pricing boundary
The public service description says ION MXDR is licensed per Ontinue Unit and states that Microsoft costs are billed directly by Microsoft or the CSP. Ask for the Ontinue Unit definition and a quote separating the service fee from Microsoft consumption.
Proposed acquisition
Quorum Cyber announced an agreement to acquire Ontinue on 16 September 2026. The companies said they will operate independently until the deal closes. Buyers should confirm whether the offer, support ownership and renewal terms change during their contract.
Custom rules
The service description excludes custom analytic rules and policies in customer Microsoft products. Ask which detections remain with your team and how new use cases enter the ION library.
Pricing & contract
- Billing
- Custom
Quote-based. Ontinue's public service description says ION MXDR is licensed per Ontinue Unit, and Microsoft Sentinel, Log Analytics and Defender costs remain billed by Microsoft or the customer's CSP.
Tradeoffs & buying questions
Strengths
-
Operates Sentinel and Defender while retaining the customer tenant
-
Combines detection engineering, hunting and Cyber Advisor reviews
-
Documents prerequisites, responsibilities and approved Microsoft actions
Considerations
-
Requires the Microsoft stack and separately billed consumption
-
Customer analytic rules and policies are outside ION service coverage
-
Custom connectors and additional services can require separate fees
Ask before buying
- How are Ontinue Units calculated, and what Microsoft licenses and consumption charges are separate?
- Which actions are pre-authorized, and who owns custom rules and excluded detections?
- What connector, IoT, phishing, vulnerability and incident-response scope does our quote include?
Integrations
Platform / SIEM
- Microsoft Sentinel
Endpoint
- Microsoft Defender for Endpoint
Cloud
- Azure
Other integrations
- Ontinue ION
- Microsoft Teams
- Microsoft Entra ID
5 more integrations
- Microsoft Defender XDR
- Microsoft Defender for Cloud
- Microsoft Defender for Office 365
- Microsoft Defender for Identity
- Microsoft Defender for Cloud Apps
Common questions
Is Ontinue ION MXDR a co-managed SOC or MDR?
It is sold as MXDR, but this profile classifies it as Co-manage the SOC because Ontinue operates Microsoft Sentinel and Defender workflows with ION automation, Cyber Defenders, Cyber Advisors and Teams collaboration while the buyer keeps control of the Microsoft tenant, data sources, escalation rules and business remediation.
Does Ontinue contain threats?
Yes, within approved scope and Microsoft control limits. The service description supports active response and containment through ION automation and Cyber Defenders, but buyers should confirm which actions are predetermined, which require approval and which remain with internal IT.
Is Ontinue pricing public?
No numeric public list price was found. Ontinue says ION MXDR is licensed per Ontinue Unit, while Microsoft Sentinel, Log Analytics and Defender costs are billed separately by Microsoft or the customer's CSP.
Company details
- Headquarters
- Zurich, Switzerland
- Founded
- 2023
- SOC regions
- North America, Europe / UK, APAC