Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers
Save up to $2200 per month on a typical 3,500 seat deployment of Microsoft 365 E5 for up to 5 MB per user per day of data ingestion into Microsoft Sentinel1.
Integrated threat protection with SIEM and XDR
Get the context and automation you need to stop sophisticated, cross-domain attacks across your entire organization with security information and event management (SIEM) and extended detection and response (XDR) from Microsoft. Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers can get a data grant of up to 5 MB per user per day of Microsoft 365 data ingestion into Microsoft Sentinel.
-
Comprehensive security
Get end-to-end visibility across your resources, including users, devices, applications, and infrastructure.
-
Detect advanced threats
Defend against modern attacks with AI-driven SIEM and XDR capabilities.
-
Investigate prioritized incidents
Surface critical incidents and hunt suspicious activities at scale.
-
Enable efficient and effective response
Respond to incidents rapidly with built-in orchestration and automation of common tasks.
Offer details
Microsoft 365 E5, A5, F5, and G5, and Microsoft 365 E5, A5, F5, and G5 Security customers can receive a data grant of up to 5MB per user per day to ingest Microsoft 365 data. This offer includes the following data sources:
- Azure Active Directory (Azure AD) sign-in and audit logs
- Microsoft Cloud App Security shadow IT discovery logs
- Microsoft Information Protection logs
- Microsoft 365 advanced hunting data
The data grant will be calculated automatically and applied to your bill, covering the cost of up to 5 MB of data ingestion per user per day.
In addition to this data grant, the following Microsoft 365 data sources are always free for all Microsoft Sentinel users:
- Azure Activity Logs
- Office 365 Audit Logs (all SharePoint activity and Exchange admin activity)
- Alerts from Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps.
1Calculation based on pay-as-you-go prices for Microsoft Sentinel and Azure Monitor Log Analytics for US East region. Exact savings will depend on benefit utilization and customer's effective price after any applicable discounts.
Offer eligibility
This data grant is available to Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers who have Enterprise (EA), Enterprise Subscription (EAS), or Cloud Solution Provider (CSP) Agreements and Enrollments. New Microsoft 365 E5, A5, F5, and G5 or Microsoft 365 E5, A5, F5, and G5 Security customers are also qualified for this data grant. Once a customer becomes eligible, they will begin benefiting from the data grant starting with their first month of eligibility.
Get started
Enable comprehensive protection with Microsoft 365 and Microsoft Sentinel. Start ingesting Microsoft 365 data into Microsoft Sentinel, and your Microsoft 365 E5, A5, F5, or G5 or Microsoft 365 E5, A5, F5, or G5 Security data grant will apply automatically, with no additional sign-up required.
Microsoft waives all entitlement to compensation for the services provided to you under this agreement. Microsoft intends that these services and associated terms comply with applicable laws and regulations with respect to gratuitous services. It is specifically understood that all services and services deliverables provided are for the sole benefit and use of the government entity and are not provided for the personal use or benefit of any individual government employee.
Get started now and see what you can do with integrated SIEM and XDR.
FAQ
-
Microsoft 365 A5 and Microsoft 365 A5 Security Microsoft 365 A5 Security for faculty Microsoft 365 A5 for faculty Microsoft 365 A5 for students Microsoft 365 A5 Security for students Microsoft 365 A5 Suite features for faculty Microsoft 365 A5 Suite features for students Microsoft 365 A5 with Calling Minutes for Faculty Microsoft 365 A5 with Calling Minutes for Students Microsoft 365 A5 without Audio Conferencing for faculty Microsoft 365 A5 without Audio Conferencing for students Microsoft 365 E5 and Microsoft 365 E5 Security Microsoft 365 E5 Security Microsoft 365 E5 Microsoft 365 E5 Security for EMS E5 Microsoft 365 E5 Security_USGOV_GCCHIGH Microsoft 365 E5 Suite features Microsoft 365 E5 with Calling Minutes Microsoft 365 E5 without Audio Conferencing Microsoft 365 E5_USGOV_GCCHIGH Microsoft 365 F5 and Microsoft 365 F5 Security Microsoft 365 F5 Security + Compliance Add-on Microsoft 365 F5 Security + Compliance Add-on AR (DOD)_USGOV_DOD Microsoft 365 F5 Security + Compliance Add-on AR_USGOV_GCCHIGH Microsoft 365 F5 Security + Compliance Add-on GCC Microsoft 365 F5 Security Add-on Microsoft 365 F5 Security Add-on AR_USGOV_DOD Microsoft 365 F5 Security Add-on AR_USGOV_GCCHIGH Microsoft 365 F5 Security Add-on GCC Microsoft 365 Security and Compliance for FLW Microsoft 365 G5 and Microsoft G5 Security Microsoft 365 G5 Security GCC Microsoft 365 G5 GCC Suite features Microsoft 365 G5 Security_USGOV_DOD Microsoft 365 G5_USGOV_DOD Microsoft 365 G5_USGOV_DOD Microsoft 365 G5 GCC -
Data Connector Data Type Azure Active Directory (audit and sign-in logs) SigninLogs AuditLogs AADNonInteractiveUserSignInLogs AADServicePrincipalSignInLogs AADManagedIdentitySignInLogs AADProvisioningLogs ADFSSignInLogs Microsoft Defender for Cloud Apps McasShadowItReporting Azure Information Protection InformationProtectionLogs_CL Microsoft 365 Defender Suite DeviceEvents DeviceFileEvents DeviceImageLoadEvents DeviceInfo DeviceLogonEvents DeviceNetworkEvents DeviceNetworkInfo DeviceProcessEvents DeviceRegistryEvents DeviceFileCertificateInfo DynamicEventCollection CloudAppEvents EmailAttachmentInfo EmailEvents EmailPostDeliveryEvents EmailUrlInfo IdentityLogonEvents IdentityQueryEvents IdentityDirectoryEvents AlertEvidence -
With this benefit, each user may ingest up to 5 MB of eligible data daily through free Azure meters. To verify that you're using the benefit, view your costs in a table format in the cost analysis tab under Subscription. Group your costs by meter and search for "M365". If you've used the offer in the selected time range, you'll see a zero-dollar charge for the Microsoft 365 meters.
-
Use the Microsoft Sentinel Cost workbook in the Workbooks gallery to estimate your total cost savings. Enter details such as your tenant's total number of eligible seats to calculate total potential savings for a custom time range or export your usage details to see the exact data volumes you've received for free so far.