Coverage here is keyed to the ingestion path, not to the vendor. If a log source lands in Microsoft Sentinel, Defender Experts analysts can work it [1]. Microsoft names Palo Alto Networks, Amazon Web Services and Okta, then writes "and more" without publishing a list [2]. So the scope of the service becomes a function of the customer's connector inventory rather than of a support matrix, which is the first thing to put to a Microsoft seller: which tables, and does the threat hunting reach third-party data or only the detection [4].
The announcement sits in a monthly roundup dated August 27, 2026, between an Entra tenant governance item and Intune device enrollment [5][8]. Same post: Purview auto-labeling moves from 100,000 to 500,000 SharePoint and OneDrive files per day [6], a fivefold ceiling increase [7]. Also in it, Windows Unattended Support with Remote Sign-In lets IT and support staff sign in to a device remotely without involving the user, with role-based permissions, compliance checks and session auditing built in [10] - a control set that puts all the weight on who holds the role and on whether anyone reads the session audit afterwards. And new Secure Now guidance tells customers to constrain agent-initiated actions that happen without explicit user approval [9]. A change in what a paid analyst queue watches got release-note treatment alongside all of that.
What the post does not carry is the part procurement needs. There is no price for MDR P2 and no delta against P1 [3]. There is no response commitment specific to third-party sources, and nothing on whether an Okta alert moves through the analyst queue the way a Defender alert does [1][4]. Those absences are where the repricing happens anyway. An operator running Sentinel plus a separate MDR contract has been paying two parties to read one set of tables, and one of those parties now sells the coverage as a tier upgrade [1][3]. That is enough to reopen the contract before anyone publishes a number.
