Microsoft Sentinel Expert & SIEM Consultant

What is Microsoft Sentinel?

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR platform. It collects security telemetry from across the estate, correlates it into incidents, and drives automated response, all without a server to size or an appliance to renew. Data arrives through data connectors, of which there are hundreds covering Microsoft services, the major cloud providers, firewalls and network gear, identity platforms, and third-party SaaS, plus Syslog and CEF for everything else. Detection is driven by analytics rules: scheduled KQL queries, near-real-time rules, Microsoft security rules that promote product alerts into incidents, and anomaly rules. UEBA adds behavioural baselining per user and per entity so a deviation gets flagged even when no signature matches.

Response is handled by SOAR playbooks built on Azure Logic Apps, which is a genuine advantage: you get a full workflow engine with hundreds of connectors rather than a bolt-on scripting box, so a playbook can disable an Entra account, isolate a device in Defender for Endpoint, post to Teams, raise a ticket, and wait for approval in a single flow. Workbooks provide the visual layer for reporting and monitoring, and threat hunting with KQL is where experienced analysts spend their time, using hunts, bookmarks, livestream, and notebooks to chase a hypothesis rather than wait for an alert.

Now the part that decides whether a deployment succeeds: ingestion cost. This is the number one problem in real Sentinel deployments, and it is almost always self-inflicted. Somebody connects everything, sends verbose firewall and proxy logs into the analytics tier at full fidelity, and three months later there is an invoice nobody can defend. The controls exist and they work. A set of data sources is free, including Azure Activity logs, Office 365 audit logs covering SharePoint, Exchange admin activity, and Teams, and security alerts from Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud Apps, and Defender for Cloud. Ingestion-time transformations let you drop columns and filter events before they are billed. Data tiering lets each table sit in the analytics, basic, auxiliary, or data lake tier according to how it is actually used. Commitment tier pricing starts at 100 GB per day and is significantly cheaper than pay-as-you-go once volume is predictable. The first 90 days of retention are included at no charge. The Microsoft Sentinel data lake then holds high-volume, low-value data cheaply for long-term retention and large-scale analytics, billed on a uniform 6:1 compression assumption, which is how you keep years of logs for a regulator without paying SIEM rates for them.

On product direction in 2026, the unification is real and largely done. Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers with no Defender XDR and no E5 licence, and most customers onboarding after 1 July 2025 are onboarded there automatically. Microsoft has confirmed that after 31 March 2027 Sentinel will no longer be supported in the Azure portal and will be available only in the Defender portal, with existing Azure portal users redirected. That date was extended from an earlier target following customer feedback, so treat it as firm but not the last word. Practically, the Defender portal brings a unified incident queue across SIEM and XDR, unified advanced hunting across Sentinel, Defender, and the data lake, case management, SOC optimisation recommendations, native multi-tenant operations for MSSPs, and Security Copilot embedded in investigation. Microsoft has also said plainly that the Defender portal is the primary innovation surface and the Azure experience is in parity and maintenance mode. If you are still working in the Azure portal, the transition is not urgent this quarter but it should be on the plan.

Why Microsoft Sentinel for UAE Organisations?

Building a SOC in the UAE runs into two constraints quickly: qualified analysts are scarce and expensive, and hardware-based SIEM projects tie up capital before they produce a single detection. Sentinel removes the second constraint entirely and softens the first, because the automation layer and the Security Copilot integration mean a smaller team can cover more. For organisations that have been quoted an appliance refresh and a professional services block to go with it, that comparison is usually decisive.

On regulation, logging and retention are not optional here. NESA and the UAE Information Assurance Standards require monitoring and incident response capability with evidence. CBUAE requirements push financial institutions towards continuous monitoring and defined incident reporting timelines. DESC sets expectations for Dubai government entities, and ADGM, DIFC, and the federal PDPL all imply you can reconstruct who touched personal data and when. Sentinel handles the retention problem economically through the data lake tier rather than forcing a choice between compliance and budget.

Data residency is the question that always follows, and it has a real answer: the Sentinel workspace is a Log Analytics workspace in an Azure region that you choose, and Microsoft operates UAE regions. That is not automatic, though. Workspace placement, the location of any Logic Apps used in playbooks, and the storage behind long-term retention all have to be set deliberately at deployment. It is one of the first things I check on a workspace someone else built in a hurry.