Skip navigation

Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers

Save up to $2200 per month on a typical 3,500 seat deployment of Microsoft 365 E5 for up to 5 MB per user per day of data ingestion into Microsoft Sentinel1.

Integrated threat protection with SIEM and XDR

Get the context and automation you need to stop sophisticated, cross-domain attacks across your entire organisation with security information and event management (SIEM) and extended detection and response (XDR) from Microsoft. Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers can get a data grant of up to 5 MB per user per day of Microsoft 365 data ingestion into Microsoft Sentinel.

  • Comprehensive security

    Get end-to-end visibility across your resources, including users, devices, applications and infrastructure.

  • Detect advanced threats

    Defend against modern attacks with AI-driven SIEM and XDR capabilities.

  • Investigate prioritised incidents

    Surface critical incidents and hunt suspicious activities at scale.

  • Enable efficient and effective response

    Respond to incidents rapidly with built-in orchestration and automation of common tasks.

Offer details

Microsoft 365 E5, A5, F5, and G5, and Microsoft 365 E5, A5, F5, and G5 Security customers can receive a data grant of up to 5MB per user per day to ingest Microsoft 365 data. This offer includes the following data sources:

  • Azure Active Directory (Azure AD) sign-in and audit logs
  • Microsoft Cloud App Security shadow IT discovery logs
  • Microsoft information protection logs
  • Microsoft 365 advanced hunting data

The data grant will be calculated automatically and applied to your note, covering the cost of up to 5 MB of data ingestion per user per day.

In addition to this data grant, the following Microsoft 365 data sources are always free for all Microsoft Sentinel users:

  • Azure activity logs
  • Office 365 audit logs (all SharePoint activity and Exchange admin activity)
  • Alerts from Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps.

1Calculation based on pay-as-you-go prices for Microsoft Sentinel and Azure Monitor Log Analytics for US East region. Exact savings will depend on benefit utilisation and customer's effective price after any applicable discounts.

Offer eligibility

This data grant is available to Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers who have Enterprise (EA), Enterprise Subscription (EAS), or Cloud Solution Provider (CSP) Agreements and Enrolments. New Microsoft 365 E5, A5, F5, and G5 or Microsoft 365 E5, A5, F5, and G5 Security customers are also qualified for this data grant. Once a customer becomes eligible, they will begin benefiting from the data grant starting with their first month of eligibility.

Getting started

Enable comprehensive protection with Microsoft 365 and Microsoft Sentinel. Start ingesting Microsoft 365 data into Microsoft Sentinel, and your Microsoft 365 E5, A5, F5, or G5 or Microsoft 365 E5, A5, F5, or G5 Security data grant will apply automatically, with no additional sign-up required.

Microsoft waives all entitlement to compensation for the services provided to you under this agreement. Microsoft intends that these services and associated terms comply with applicable laws and regulations with respect to gratuitous services. It is specifically understood that all services and services deliverables provided are for the sole benefit and use of the government entity and are not provided for the personal use or benefit of any individual government employee.

Get started now and see what you can do with integrated SIEM and XDR.

FAQ

  • Microsoft 365 A5 and Microsoft 365 A5 Security
    Microsoft 365 A5 Security for faculty
    Microsoft 365 A5 for faculty
    Microsoft 365 A5 for students
    Microsoft 365 A5 Security for students
    Microsoft 365 A5 Suite features for faculty
    Microsoft 365 A5 Suite features for students
    Microsoft 365 A5 with Calling Minutes for Faculty
    Microsoft 365 A5 with Calling Minutes for Students
    Microsoft 365 A5 without Audio Conferencing for faculty
    Microsoft 365 A5 without Audio Conferencing for students
    Microsoft 365 E5 and Microsoft 365 E5 Security
    Microsoft 365 E5 Security
    Microsoft 365 E5
    Microsoft 365 E5 Security for EMS E5
    Microsoft 365 E5 Security_USGOV_GCCHIGH
    Microsoft 365 E5 Suite features
    Microsoft 365 E5 with Calling Minutes
    Microsoft 365 E5 without Audio Conferencing
    Microsoft 365 E5_USGOV_GCCHIGH
    Microsoft 365 F5 and Microsoft 365 F5 Security
    Microsoft 365 F5 Security + Compliance Add-on
    Microsoft 365 F5 Security + Compliance Add-on AR (DOD)_USGOV_DOD
    Microsoft 365 F5 Security + Compliance Add-on AR_USGOV_GCCHIGH
    Microsoft 365 F5 Security + Compliance Add-on GCC
    Microsoft 365 F5 Security Add-on
    Microsoft 365 F5 Security Add-on AR_USGOV_DOD
    Microsoft 365 F5 Security Add-on AR_USGOV_GCCHIGH
    Microsoft 365 F5 Security Add-on GCC
    Microsoft 365 Security and Compliance for FLW
    Microsoft 365 G5 and Microsoft G5 Security
    Microsoft 365 G5 Security GCC
    Microsoft 365 G5 GCC Suite features
    Microsoft 365 G5 Security_USGOV_DOD
    Microsoft 365 G5_USGOV_DOD
    Microsoft 365 G5_USGOV_DOD
    Microsoft 365 G5 GCC
  • Data Connector Data Type
    Azure Active Directory (audit and sign-in logs) SigninLogs
    AuditLogs
    AADNonInteractiveUserSignInLogs
    AADServicePrincipalSignInLogs
    AADManagedIdentitySignInLogs
    AADProvisioningLogs
    ADFSSignInLogs
    Microsoft Defender for Cloud Apps McasShadowItReporting
    Azure Information Protection InformationProtectionLogs_CL
    Microsoft 365 Defender Suite DeviceEvents
    DeviceFileEvents
    DeviceImageLoadEvents
    DeviceInfo
    DeviceLogonEvents
    DeviceNetworkEvents
    DeviceNetworkInfo
    DeviceProcessEvents
    DeviceRegistryEvents
    DeviceFileCertificateInfo
    DynamicEventCollection
    CloudAppEvents
    EmailAttachmentInfo
    EmailEvents
    EmailPostDeliveryEvents
    EmailUrlInfo
    IdentityLogonEvents
    IdentityQueryEvents
    IdentityDirectoryEvents
    AlertEvidence
  • With this benefit, each user may ingest up to 5 MB of eligible data daily through free Azure metres. To verify that you're using the benefit, view your costs in a table format in the cost analysis tab under Subscription. Group your costs by meter and search for "M365". If you've used the offer in the selected time range, you'll see a zero-dollar charge for the Microsoft 365 metres.
  • Use the Microsoft Sentinel Cost workbook in the Workbooks gallery to estimate your total cost savings. Enter details such as your tenant's total number of eligible seats to calculate total potential savings for a customised time range or export your usage details to see the exact data volumes you've received for free so far.