Microsoft Sentinel as SIEM and SOAR on a Log Analytics workspace, its components, the analytics and data lake tiers, pricing and the E5 data grant, the Defender portal as the only home after March 2027, and how to decide on one workspace or many.
Page-by-page walk of Settings in the Defender portal, which product owns each page, which toggles reach across products, how device groups drive automation and RBAC, and how to audit who changed what.
The three permission layers in the Defender portal, Entra global roles, the legacy per-product RBAC for MDE, MDO, MDA and MDI, and unified RBAC with its permission groups, data sources, scoping, activation, import and the 2026 auto-enablement.