SOC Providers.com Security Operations Center providers
Last reviewed: 1 Jun 2026

Ontinue ION MXDR

MDR · XDR · Co-Managed SOC

Ontinue ION MXDR is a Microsoft-focused co-managed SOC service built around Microsoft Sentinel, Defender, Teams and Ontinue's ION platform. After an alert, ION automation and Cyber Defenders triage, investigate and can execute approved containment actions, while the buyer still owns Microsoft licensing, source onboarding, response approvals and IT remediation.

What they do
Co-manage the SOC
Works with
Your stack
Built for
Mid-Market / Enterprise
Price
Quote-based, licensed per Ontinue Unit
Best for
Microsoft-first security teams that want Sentinel and Defender operated with outside SOC help

They cover

  • Endpoints
  • Cloud Workloads
  • Identity & Access
  • Email
  • Network
  • SaaS Applications

Your team still owns

  • Buying and maintaining required Microsoft Sentinel, Log Analytics, Defender and Teams licensing
  • Connecting and maintaining customer log sources, agents, tenants and workspaces
  • Keeping escalation contacts, response rules and approval paths current
  • Performing IT remediation or business-owner decisions outside approved playbooks
  • Scoping paid consulting, IoT, phishing or vulnerability add-ons when the base MXDR service does not include them

Pricing

Line Figure
Published price Quote-based, licensed per Ontinue Unit
Billing model Custom
Contract Not published
Onboarding Not published

Tradeoffs

Works well

  • Strong fit for buyers already committed to Microsoft Sentinel, Defender, Entra and Teams
  • Public service documents explain customer responsibilities, required licenses, log-source handling and SLA targets
  • Teams-based collaboration gives customers visibility into ownership and next actions during escalations
  • Follow-the-sun Cyber Defense Centers and Cyber Advisors support a shared operating model, not only alert forwarding

Watch out for

  • Not a good fit for buyers that want a neutral MDR provider over a non-Microsoft primary stack
  • Microsoft licensing, Sentinel ingestion and Log Analytics costs remain buyer-owned
  • Custom log ingestion and difficult connector work can require consulting or billable maintenance
  • Public pricing does not expose a numeric list price or the Ontinue Unit definition

What buyers say

Alert noise

Not assessed

Transparency

Not assessed

Customers like

  • Reviews highlight Teams-based event delivery and clear next-action ownership
  • Customers call out automation that reduces routine incident handling
  • Some reviewers describe proactive threat hunting and recommendations for SIEM and incident-response process improvement

Watch out for

  • At least one visible critical theme mentions slow response or missed response elements
  • Public non-Gartner review depth is limited
  • Reddit discussion is mostly category-level managed SOC and Sentinel scope, not deep Ontinue customer evidence

Reputation reads from public reviews, not vendor-published numbers.

Sources
Gartner Peer InsightsReddit Managed SOC discussionReddit Managed SOC and SIEM discussion

Ask before buying

  1. What is an Ontinue Unit for our environment, and how will Sentinel ingestion or Log Analytics costs change?
  2. Which response actions can ION Automate or Cyber Defenders take without waiting for our approval?
  3. Which Microsoft, third-party, IoT, phishing and vulnerability sources are included in the base MXDR scope?

Integrations

Microsoft SentinelOntinue ION PlatformMicrosoft Defender for EndpointMicrosoft Defender XDRAzureMicrosoft 365Microsoft Defender for CloudMicrosoft TeamsMicrosoft Entra IDMicrosoft Defender for IdentityMicrosoft Defender for Office 365Microsoft Defender for Cloud AppsASIM-supported IDS, proxy, DNS and firewall sources

Editorial notes

Why co-managed SOC

Ontinue does more than investigate and advise because its service documents support ION automation, Cyber Defender remediation, Cyber Advisors, detection engineering, threat hunting and a Teams-based collaboration workflow. It is still co-managed because customers operate their own Microsoft tenant, log sources, escalation matrix and response authority.

Containment boundary

Public sources support active response and containment through Microsoft controls, including Defender for Endpoint deployment requirements and predetermined response actions. Buyers should not assume every containment action is automatic, because the service also relies on rules of engagement and customer escalation paths.

Microsoft dependency

Ontinue is intentionally Microsoft-focused. That is useful for buyers standardizing on Sentinel, Defender, Entra and Teams, but it is a weaker fit for teams that want a vendor-neutral MDR layer over CrowdStrike, SentinelOne, Splunk or a non-Microsoft SIEM as the primary control plane.

Pricing boundary

The public service description says ION MXDR is licensed per Ontinue Unit and states that Microsoft costs are billed directly by Microsoft or the CSP. No public numeric Ontinue list price was found, so the public profile should avoid indicative dollar ranges.

Review evidence

Gartner Peer Insights has meaningful Ontinue ION MXDR review volume, but other public review surfaces and Reddit threads are thin or category-level. Public sentiment should mention Gartner themes and use Reddit only as a buying caveat about managed SOC and Microsoft Sentinel scope.

Questions

Is Ontinue ION MXDR a co-managed SOC or MDR?
It is sold as MXDR, but this profile classifies it as Co-manage the SOC because Ontinue operates Microsoft Sentinel and Defender workflows with ION automation, Cyber Defenders, Cyber Advisors and Teams collaboration while the buyer keeps control of the Microsoft tenant, data sources, escalation rules and business remediation.
Does Ontinue contain threats?
Yes, within approved scope and Microsoft control limits. The service description supports active response and containment through ION automation and Cyber Defenders, but buyers should confirm which actions are predetermined, which require approval and which remain with internal IT.
Is Ontinue pricing public?
No numeric public list price was found. Ontinue says ION MXDR is licensed per Ontinue Unit, while Microsoft Sentinel, Log Analytics and Defender costs are billed separately by Microsoft or the customer's CSP.