Microsoft Sentinel benefit for Microsoft 365 E5, A5, F5, and G5 customers
Save up to $2,200 per month on a typical 3,500 seat deployment of Microsoft 365 E5 for up to 5 MB per user per day of data ingestion into Microsoft Sentinel.1
Integrated threat protection with SIEM and XDR
Get the context and automation you need to stop sophisticated, cross-domain attacks across your entire organization with security information and event management (SIEM) and extended detection and response (XDR) from Microsoft. Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers can get a data grant of up to 5 MB per user per day of Microsoft 365 data ingestion into Microsoft Sentinel.
-
Comprehensive security
Get end-to-end visibility across your resources, including users, devices, applications, and infrastructure.
-
Detect advanced threats
Defend against modern attacks with AI-driven SIEM and XDR capabilities.
-
Investigate prioritized incidents
Surface critical incidents and hunt suspicious activities at scale.
-
Enable efficient and effective response
Respond to incidents rapidly with built-in orchestration and automation of common tasks.
Offer details
Microsoft 365 E5, A5, F5, and G5, and Microsoft 365 E5, A5, F5, and G5 Security customers can receive a data grant of up to 5MB per user per day to ingest Microsoft 365 data. This offer includes the following data sources:
- Microsoft Entra ID (formerly Azure AD) sign-in and audit logs
- Microsoft Defender for Cloud Apps Guard shadow IT discovery logs
- Microsoft Purview Information Protection logs
- Microsoft 365 advanced hunting data
The data grant will be calculated automatically and applied to your bill, covering the cost of up to 5 MB of data ingestion per user per day.
In addition to this data grant, the following Microsoft 365 data sources are always free for all Microsoft Sentinel users:
- Azure Activity Logs
- Office 365 Audit Logs (all SharePoint activity and Exchange admin activity)
- Alerts from Microsoft Defender for Cloud, Microsoft 365 Defender, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Endpoint, and Microsoft Defender for Cloud Apps.
- [1] Calculation based on pay-as-you-go prices for Microsoft Sentinel and Azure Monitor Log Analytics for US East region. Exact savings will depend on benefit utilization and customer's effective price after any applicable discounts.
Offer eligibility
This data grant is available to Microsoft 365 E5, A5, F5, and G5 and Microsoft 365 E5, A5, F5, and G5 Security customers who have Enterprise (EA), Enterprise Subscription (EAS), or Cloud Solution Provider (CSP) Agreements and Enrollments. New Microsoft 365 E5, A5, F5, and G5 or Microsoft 365 E5, A5, F5, and G5 Security customers are also qualified for this data grant. Once a customer becomes eligible, they will begin benefiting from the data grant starting with their first month of eligibility.
-
Get started
Enable comprehensive protection with Microsoft 365 and Microsoft Sentinel. Start ingesting Microsoft 365 data into Microsoft Sentinel, and your Microsoft 365 E5, A5, F5, or G5 or Microsoft 365 E5, A5, F5, or G5 Security data grant will apply automatically, with no additional sign-up required.
Microsoft waives all entitlement to compensation for the services provided to you under this agreement. Microsoft intends that these services and associated terms comply with applicable laws and regulations with respect to gratuitous services. It is specifically understood that all services and services deliverables provided are for the sole benefit and use of the government entity and are not provided for the personal use or benefit of any individual government employee.
Get started now and see what you can do with integrated SIEM and XDR.
FAQ
-
Microsoft 365 A5 and Microsoft 365 A5 Security
Microsoft 365 A5 Security for faculty
Microsoft 365 A5 for faculty
Microsoft 365 A5 for students
Microsoft 365 A5 Security for students
Microsoft 365 A5 Suite features for faculty
Microsoft 365 A5 Suite features for students
Microsoft 365 A5 with Calling Minutes for Faculty
Microsoft 365 A5 with Calling Minutes for Students
Microsoft 365 A5 without Audio Conferencing for faculty
Microsoft 365 A5 without Audio Conferencing for students
Microsoft 365 E5 and Microsoft 365 E5 SecurityMicrosoft 365 E5 Security
Microsoft 365 E5
Microsoft 365 E5 Security for EMS E5
Microsoft 365 E5 Security_USGOV_GCCHIGH
Microsoft 365 E5 Suite features
Microsoft 365 E5 with Calling Minutes
Microsoft 365 E5 without Audio Conferencing
Microsoft 365 E5_USGOV_GCCHIGH
Microsoft 365 F5 and Microsoft 365 F5 SecurityMicrosoft 365 F5 Security + Compliance Add-on
Microsoft 365 F5 Security + Compliance Add-on AR (DOD)_USGOV_DOD
Microsoft 365 F5 Security + Compliance Add-on AR_USGOV_GCCHIGH
Microsoft 365 F5 Security + Compliance Add-on GCC
Microsoft 365 F5 Security Add-on
Microsoft 365 F5 Security Add-on AR_USGOV_DOD
Microsoft 365 F5 Security Add-on AR_USGOV_GCCHIGH
Microsoft 365 F5 Security Add-on GCC
Microsoft 365 Security and Compliance for FLW
Microsoft 365 G5 and Microsoft G5 SecurityMicrosoft 365 G5 Security GCC
Microsoft 365 G5 GCC Suite features
Microsoft 365 G5 Security_USGOV_DOD
Microsoft 365 G5_USGOV_DOD
Microsoft 365 G5_USGOV_DOD
Microsoft 365 G5 GCC
-
Data Connector Data Type Microsoft Entra ID (audit and sign-in logs)
SigninLogs
AuditLogs
AADNonInteractiveUserSignInLogs
AADServicePrincipalSignInLogs
AADManagedIdentitySignInLogs
AADProvisioningLogs
ADFSSignInLogs
Microsoft Defender for Cloud Apps
McasShadowItReporting
Azure Information Protection
InformationProtectionLogs_CL
Microsoft 365 Defender Suite
CloudAppEvents
EmailAttachmentInfo
EmailEvents
EmailPostDeliveryEvents
EmailUrlInfo
IdentityLogonEvents
IdentityQueryEvents
IdentityDirectoryEvents
AlertEvidence
-
With this benefit, each user may ingest up to 5 MB of eligible data daily through free Azure meters. To verify that you're using the benefit, view your costs in a table format in the cost analysis tab under Subscription. Group your costs by meter and search for "M365". If you've used the offer in the selected time range, you'll see a zero-dollar charge for the Microsoft 365 meters.
-
Use the Microsoft Sentinel Cost workbook in the Workbooks gallery to estimate your total cost savings. Enter details such as your tenant's total number of eligible seats to calculate total potential savings for a custom time range or export your usage details to see the exact data volumes you've received for free so far.