How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
Every documented product-to-product link in the Defender family, where each switch lives, what it needs, what it unlocks, and how to prove it is working.
Every way a server can be licensed for Defender for Endpoint - Defender for Servers Plan 1 and Plan 2 through Defender for Cloud, the standalone Defender for Endpoint for Servers licence, and the Defender for Business servers add-on - with the billing model, OS support and how to enable the plan by portal, CLI and ARM.
Defender for Cloud as a CNAPP, the free foundational CSPM layer, the paid Defender CSPM plan, the per-workload Defender plans, how plans are switched on per subscription or connector, multicloud connectors, how alerts reach Defender XDR and Sentinel, pricing shape and roles.
How Defender for Endpoint protects servers in two models, standalone MDE onboarding with a per-device server licence or Defender for Servers through Defender for Cloud billed per server-hour, what each gives up, how direct onboarding bridges them, and a decision tree.
The Microsoft 365 email protection stack in layers, Exchange Online Protection, Defender for Office 365 Plan 1 and Plan 2, what each adds, which SKUs carry which, the filtering pipeline, preset versus custom policies and the precedence order, the configuration analyzer and how to trial Plan 2 in audit mode.
What Defender for Identity detects that an MDE-onboarded domain controller cannot, how the v3.x sensor rides on the MDE agent, what the classic v2.x sensor still does better, licensing, and a three-way comparison table.
Defender for Cloud Apps as Microsoft's CASB and SaaS security layer, its four data paths (Cloud Discovery, app connectors, Conditional Access App Control, app governance), the app catalogue and risk scores, how it lands in Defender XDR, what the licences and roles are, and first-time setup.
Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.
Defender XDR as the correlation layer above MDE, MDI, MDO, MDA, Defender for Cloud and Entra ID Protection, how alerts become incidents, what attack disruption does, the shared hunting schema, Action center, Threat analytics, Secure Score, Exposure Management, licensing, and where Sentinel fits.