Microsoft launches Integrated Security Operations Center in Defender for AI agents

Microsoft has launched an Integrated Security Operations Center (ISOC) in Microsoft Defender, moving security information and event management features out of Microsoft Sentinel and into the Defender portal. The company said the redesign rebuilds its security operations products around artificial intelligence agents.

ISOC gives agents the same signals, context and controls as a human analyst, with core security workflows wired in by default so an agent can investigate an incident and act on it without a separate operating model. Case management, workbooks and a feature that writes automation playbooks from plain-language instructions work in the Defender portal without setup, while user and entity behaviour analytics and third-party data ingestion require a dedicated ISOC workspace linked to an Azure subscription. More than 500 connectors are available, and Microsoft warned that ingestion charges may apply.

The service builds on Project Perception, introduced in July alongside MAI-Cyber-1-Flash, Microsoft’s first in-house security model. High-stakes actions still need human approval, an approach Rob Lefferts, corporate vice president of Microsoft Threat Protection, described as strategy stays human.

The public preview opens today to customers with Microsoft Defender Suite, Microsoft 365 E5 or Microsoft 365 E7 licences. Organisations already running an active Microsoft Sentinel workspace are excluded for now. Defender data is retained for 30 days at no extra charge during the preview, and pricing has not been disclosed. A Tech Community ask-me-anything session is scheduled for 6 October.