Who does what
Provider
- Operate Sentinel detections
- Investigate security cases
- Coordinate MXDR incidents
Your team
- Maintain source controls
- Set response permissions
- Own wider recovery
Coverage
- Endpoints
- Network
- Cloud Workloads
- Identity & Access
Details
Service scope
Best for Teams retaining endpoint and infrastructure administration while sharing Sentinel operations and incident handling
MXDR adds incident coordination
MXDR includes wider sources and incident management. Ongoing endpoint and firewall administration remains separate.
Response depends on the action matrix
Routine permissions include some email actions. Device isolation and account locking sit under retained incident-response authority.
Delivery includes service partners
Redcentric and its partners deliver the service. Confirm the named operator, escalation route and response labour terms.
Full service analysis
Redcentric's MXDR tier manages Sentinel detections, investigates alerts and coordinates incidents across contracted endpoint, network, cloud and email sources. You maintain source systems and endpoint tooling, grant response authority and arrange remediation beyond the agreed action matrix.
- Your team owns
- Maintain source systems and endpoint security tools
- Approve response authority and escalation contacts
- Arrange wider remediation and recovery
MXDR adds incident coordination
Both tiers operate Sentinel and investigate alerts. MXDR adds wider data sources, tailored response playbooks and incident management. Ongoing administration of endpoint agents, firewalls and other source controls sits outside this service.
Response depends on the action matrix
The published default matrix permits actions such as email quarantine and malicious mailbox-rule removal. Device isolation and account locking belong to the incident-response authority column, not routine managed service. Agree the matrix before onboarding.
Delivery includes service partners
The definition assigns delivery jointly to Redcentric and key service partners. It does not name the SOC partner. Confirm the operating entity, escalation route and retained-response terms, including labour charges and recovery responsibilities.
Pricing & contract
- Billing
- Custom
Request a tier-specific quote covering users, monitored assets, onboarding, Microsoft consumption and retained incident response. The procurement rate card assumes a 36-month term but does not clearly separate MDR and MXDR pricing.
Tradeoffs & buying questions
Strengths
-
Publishes a detailed response authority matrix
-
Keeps Sentinel in the customer tenant
Considerations
-
Ongoing endpoint and firewall administration is separate
-
Routine response permissions are narrower than retained incident response
-
The published definition does not identify the delivery partner
Ask before buying
- Who operates the SOC under our contract, and which responsibilities sit with Redcentric, its delivery partner and our team?
- Which actions are approved in managed service versus retained incident response, and who authorises device isolation or account locking overnight?
- What does the MXDR quote include for Microsoft consumption, custom connectors, response labour, onboarding and data export?
Integrations
Platform / SIEM
- Microsoft Sentinel
Endpoint
- Microsoft Defender for Endpoint
Cloud
- Microsoft Azure
Other integrations
- Azure Lighthouse
- Microsoft 365
Common questions
Does a response retainer mean unlimited incident work?
The definition includes an incident-response retainer unless opted out. It separately excludes human-resource costs from service-management tooling fees. Agree included response hours, labour charges and recovery duties in the order.