Microsoft Enables Single Security Operators to Handle Work That Previously Required Entire Teams Through AI-Powered Platform

Microsoft has launched a public preview of its Integrated Security Operations Center (ISOC) in Microsoft Defender, a platform that enables single operators working with AI agent frameworks to perform tasks that traditionally required entire security teams. The September 23 release consolidates security information and event management features from Microsoft Sentinel into a unified system designed to counter the growing sophistication of AI-powered cyberattacks.

AI Agents Support Human-Led Threat Response

"What once required entire teams now requires a single operator and an agent framework," Rob Lefferts, Corporate Vice President of Microsoft Threat Protection, wrote in announcing the platform. The system addresses a problem Microsoft says is worsening as attackers deploy their own AI agents: defenders fall behind when protection and day-to-day operations run as separate systems and analysts must piece incidents together manually across multiple tools.

Built on Project Perception—the system Microsoft introduced in July alongside MAI-Cyber-1-Flash, its first in-house security model—the ISOC platform provides AI agents with the same signals, context, and controls available to human analysts. Core security workflows are integrated by default, allowing agents to investigate incidents and act on them without requiring a separate operating model. However, agents still require human approval for high-stakes actions, and people set the priorities in what Lefferts described as a "strategy stays human" approach.

Platform Features and Setup Requirements

Several features ISOC brings over from Sentinel work in the Defender portal without any setup, according to Microsoft's documentation. These include automated case management, workbooks, and a feature that generates automation playbooks from plain-language instructions.

However, some ISOC capabilities—including user and entity behavior analytics and the ability to ingest data from Azure and third-party sources—require additional configuration. Organizations must first create a dedicated ISOC workspace linked to an Azure subscription. Microsoft offers more than 500 connectors for external data sources, though the company warns that ingestion charges may apply.

Microsoft is also promoting what it calls an integrated protection loop, where telemetry, exposure data, and threat intelligence feed directly into Defender's controls. Lefferts pointed to the existing attack disruption feature in Defender, which acts on intrusions while they are still underway, as an example of this loop in operation. The agents "depend on the rest of the stack working as one," Lefferts noted.

Availability and Pricing

The ISOC public preview is available to customers with Microsoft Defender Suite, Microsoft 365 E5, or Microsoft 365 E7 licenses. Organizations currently running an active Microsoft Sentinel workspace are excluded from the preview for now.

During the preview period, Microsoft is offering 30 days of Defender data retention at no extra charge. The company has not disclosed final pricing for the platform. Microsoft has scheduled a Tech Community ask-me-anything session for October 6, where organizations can learn more about ISOC's capabilities and implementation requirements.

Sources

1. Microsoft unveils Integrated Security Operations Center in Defender for AI agents — SiliconANGLE