How to Set Up Microsoft Sentinel | Beginner Guide
Microsoft Sentinel is a cloud-native SIEM and SOAR platform. It collects security logs from across your Microsoft 365 and Azure environment, runs analytics to detect threats, and lets you investigate from a single console.
Prerequisites and cost
- An Azure subscription
- Log Analytics Contributor and Sentinel Contributor roles in Azure
Create a Log Analytics workspace
- Choose subscription and resource group
- Name: sentinel-workspace-prod
- Region: UK South for UK organisations
- After creating, go to the workspace and click Microsoft Sentinel → Add Microsoft Sentinel
Connect M365 data sources
Install the solution pack which includes connectors for Office 365, Entra ID, Microsoft 365 Defender, and Defender for Cloud Apps. Go to Data connectors, select each, and click Connect.
Enable analytics rules
Frequently Asked Questions
No. M365 Defender is the XDR platform for M365 workloads. Sentinel is a separate SIEM that ingests data from Defender and many other sources.
Pricing is based on data ingestion, approximately £2.30/GB. Use the Sentinel cost estimator at azure.microsoft.com to estimate monthly cost.
KQL (Kusto Query Language) is the query language for Sentinel. You do not need it to get started - pre-built rules work without it. Learning KQL significantly increases what you can do for threat hunting.