Microsoft puts Defender Experts analysts on Palo Alto, AWS and Okta logs through Sentinel
Microsoft's managed detection service now works third-party telemetry ingested into Sentinel, on the MDR P2 tier and with no published price. Anyone paying a separate provider to read those same tables has a renewal conversation.
The Watch · Security desk
What happened
- Microsoft Defender Experts MDR, its human-analyst managed detection service, now covers third-party data sources that customers ingest through Microsoft Sentinel.
- The coverage ships only on the Defender Experts MDR P2 tier, and the announcement carries no price for that tier.
- Microsoft frames it as around-the-clock detection, response and threat hunting spanning both its own telemetry and third-party telemetry in one service.
- The change appeared in the August 27, 2026 monthly Microsoft Security roundup rather than in a standalone product announcement.
Why it matters
- cost Buyers running Sentinel and a separate MDR contract have been funding two teams to read the same tables; clearing the duplicate now means buying a P2 upgrade whose price is not public.
- constraint Independent MDR providers who sold multi-vendor coverage as their edge over Microsoft lose that pitch and are pushed to compete on response quality, hunting depth and contract terms instead.
- exposure Scope is now whatever a customer has plumbed into Sentinel, so an uningested or misconfigured connector silently removes a log source from the paid analyst queue.
- decision SIEM consolidation stops being a tooling preference and becomes the lever that determines how much of the estate a single analyst queue can see.
Coverage here is keyed to the ingestion path, not to the vendor. If a log source lands in Microsoft Sentinel, Defender Experts analysts can work it [1]. Microsoft names Palo Alto Networks, Amazon Web Services and Okta, then writes "and more" without publishing a list [2]. So the scope of the service becomes a function of the customer's connector inventory rather than of a support matrix, which is the first thing to put to a Microsoft seller: which tables, and does the threat hunting reach third-party data or only the detection [3].
The announcement sits in a monthly roundup dated August 27, 2026, between an Entra tenant governance item and Intune device enrollment [6][8]. Same post: Purview auto-labeling moves from 100,000 to 500,000 SharePoint and OneDrive files per day [4], a fivefold ceiling increase [7]. Also in it, Windows Unattended Support with Remote Sign-In lets IT and support staff sign in to a device remotely without involving the user, with role-based permissions, compliance checks and session auditing built in [10] - a control set that puts all the weight on who holds the role and on whether anyone reads the session audit afterwards. And new Secure Now guidance tells customers to constrain agent-initiated actions that happen without explicit user approval [9]. A change in what a paid analyst queue watches got release-note treatment alongside all of that.
What the post does not carry is the part procurement needs. There is no price for MDR P2 and no delta against P1 [5]. There is no response commitment specific to third-party sources, and nothing on whether an Okta alert moves through the analyst queue the way a Defender alert does [1][3]. Those absences are where the repricing happens anyway. An operator running Sentinel plus a separate MDR contract has been paying two parties to read one set of tables, and one of those parties now sells the coverage as a tier upgrade [1][5]. That is enough to reopen the contract before anyone publishes a number.
What to watch
- A published MDR P2 list price or P1/P2 delta, which would show how much of this is bundling and how much is upsell.
- A named connector list for MDR-covered third-party tables beyond Palo Alto Networks, AWS and Okta.
- Whether incumbent MDR providers answer with multi-SIEM coverage commitments or repriced Sentinel monitoring at renewal.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence38
- Adoption18
- Hype gap+22
- Incentives88
- Confidence46
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Microsoft Defender Experts MDR now covers third-party data sources ingested through Microsoft Sentinel.
- [2]
Microsoft names the covered third-party sources as including Palo Alto Networks, Amazon Web Services (AWS), Okta, "and more", without publishing a full list.
- [3]
Microsoft describes the change as extending around-the-clock managed detection and response and threat hunting across both Microsoft native and third-party data sources.
- [4]
Auto-labeling policies in Microsoft Purview now process up to 500,000 SharePoint and OneDrive files per day, up from 100,000.
- [5]
The third-party coverage is available through Microsoft Defender Experts MDR P2; the post states no price for P2 and no price difference against P1.
- [6]
The MDR change was published in Microsoft's "What's new in Microsoft Security: August 2026" roundup post, dated August 27, 2026.
- [7]
The Purview auto-labeling ceiling is a fivefold increase.
- [8]
The same post introduces Microsoft Entra Tenant Governance, which brings an organization's tenants into a single view with centralized policies and cross-tenant delegated administration to reduce shadow-tenant risk, and Windows Autopilot device association in Intune.
- [9]
New Secure Now guidance in Microsoft Security Exposure Management focuses on constraining agent-initiated actions that occur without explicit user approval, hardening attack surfaces, governing identities and permissions, and increasing visibility.
- [10]
Windows Unattended Support with Remote Sign-In allows IT and support staff to sign in to devices remotely without involving the user, with role-based permissions, compliance checks and session auditing built in.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- microsoft.comWhat’s new in Microsoft Security: August 2026
1 article · August 27, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- MicrosoftFollow
- Microsoft Defender Experts MDRFollow
- Microsoft Defender Experts Threat IntelligenceFollow
- Microsoft SentinelFollow
- Palo Alto NetworksFollow
- Amazon Web ServicesFollow
- OktaFollow
- Microsoft Entra Tenant GovernanceFollow
- Microsoft IntuneFollow
- Microsoft PurviewFollow
- Microsoft Security Exposure ManagementFollow
- Microsoft 365 CopilotFollow
- Windows AutopilotFollow