On 23 September 2026, Microsoft announced the Integrated Security Operations Center (ISOC) in Microsoft Defender as a public preview. For small and midsized Microsoft 365 environments, this is not a reason for licence advice, but it is a concrete operations checkpoint: if Defender signals, incidents, automation, and reporting are handled in separate places today, administrators should review which new Defender portal capabilities appear and what preparation is required before additional data sources or workspaces are used.
What Microsoft announced
Microsoft describes ISOC as an expansion in the Microsoft Defender portal that brings XDR, SIEM capabilities, threat intelligence, automation, and AI together. According to Microsoft, eligible customers receive 30 days of included retention for Defender data during this preview phase. The announcement also names case management, workbooks, and natural-language playbook generation as capabilities that can start directly in the Defender portal.
The boundary matters: Microsoft says ISOC is not a new standalone product. It is a preview capability in Microsoft Defender. Existing Microsoft Sentinel environments should continue to use their current Sentinel experience during this phase; Microsoft explicitly says not to disconnect a production Sentinel workspace only to qualify for the ISOC preview.
Why this matters for SMBs
Many organizations with 10 to 250 seats do not run a permanently staffed security operations center. They still need alerts, incidents, evidence, and response actions to remain traceable. This is where the new Defender portal consolidation can matter: fewer tool switches, clearer ownership, and a shared workspace for investigation, tasks, and automation.
Case management can bring incident context, tasks, comments, and status into one work item. Workbooks can make threat, trend, and response metrics visible. Natural-language playbooks can help draft simple automation faster. Additional data sources require an ISOC workspace according to Microsoft, so they should be a deliberate operating decision rather than a casual click. For small teams, this check helps prevent a preview from becoming active without clear ownership.
Dates and preview milestones
Microsoft names three concrete dates. The public preview began on 23 September 2026. Starting 1 October 2026, eligible customers can expand visibility through more than 500 connectors using a pay-as-you-go ingestion meter; regional prices and terms can vary. Starting 15 November 2026, retention for eligible customers is planned to extend from 30 to 90 days. Existing Sentinel customers are also expected to have the choice to move to ISOC from that date if the relevant requirements are met.
For a ReByteIT guide, the key point is not licence selection but operational readiness: which data already exists in Microsoft Defender, which workflows are documented, and which additional sources would provide real investigation value?
What to check before using it
Microsoft Learn describes ISOC as a preview; capabilities and availability can change. Microsoft also distinguishes between capabilities that require a workspace and those that do not. Case management, workbooks, enhanced automation rules, and playbook generation are listed in the Learn table without an ISOC workspace requirement. UEBA, Content hub, CI/CD, threat intelligence, and Azure or third-party security data require a workspace.
- Check whether the Defender portal already shows ISOC notices or new navigation entries in your tenant.
- Document existing incident processes, roles, and escalations before customizing case fields.
- Do not remove a production Sentinel workspace connection only to test a preview capability.
- Before ingesting extra data, decide which sources add real investigation value.
- Define retention, cost control, and connector ownership before enabling broader ingestion.
Concrete next steps for administrators
The first step is an inventory, not enabling as many features as possible. In Microsoft 365 Consulting or a Microsoft Security Assessment, teams can clarify which signals are available today and where the incident process has gaps.
- Review Defender incidents from the last 30 days and note recurring manual steps.
- Define ownership for case handling, escalation, closure, and evidence retention.
- For additional data sources, start with a small and justified pilot scope.
- After preview activation, verify that playbooks and reporting remain auditable.
Official Microsoft sources
- Microsoft Defender XDR Blog: Integrated Security Operations Center in Microsoft Defender
- Microsoft Learn: Integrated Security Operations Center in Microsoft Defender
- Microsoft Security Blog: Reimagining the SOC for the agentic era
- Microsoft Defender XDR Blog: Reimagining Case Management in Microsoft Defender
If you want to check which Defender signals, incidents, and automations should be brought together in your environment, we can support a focused review – get in touch.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
