A European managed security service provider standardized its customers on Microsoft Sentinel and Defender XDR. Detection was not the problem. Running investigation and closure for dozens of tenants, one portal at a time, was. The MSSP kept Microsoft for detection and put D3 Morpheus on top as the investigation and case layer, one workspace per customer, with status written back to Sentinel. Here is how it is wired and what changed for an analyst.
Key takeaways
- Sentinel and Defender XDR are good at detection. The gap for an MSSP is everything after the incident fires, multiplied by the number of tenants.
- Morpheus connects to each customer’s Sentinel and Defender tenant, investigates the incident across both, and writes status and closure back, so the customer sees the same case state the MSSP does.
- One workspace per tenant removes portal switching. The analyst works in one interface and sees every customer’s cases, with the investigation already done.
- Autonomy is set per customer, so containment in Defender can be staged for approval for one customer and run automatically for another.
- The MSSP had no SOAR to migrate. Workflows were drafted from plain-language prompts, approved, and now run deterministically across tenants.
Terms used in this case study
Customer profile
The situation: one Microsoft stack, dozens of portals
Standardizing customers on Sentinel and Defender XDR gave the MSSP consistent detection. It did not give it a consistent way to work. Analysts operated directly inside each customer’s portals, switching tenants by hand. Context lived in whichever console happened to be open. Every new customer added another set of logins and another place to look.
Sentinel raised the incidents. What came next was manual: open the incident, pivot to Defender for the device and user, pivot back for related activity, decide, act, write it up, update the ticket. Alert volume and noise meant a large share of that effort went to the tickets least likely to matter.
The MSSP wanted two things. Low-priority alerts handled before they reached a person. And the real ones arriving with the investigation already done, in one place, regardless of which tenant they came from.
What the platform had to do
- Sit on top of Sentinel and Defender XDR, not beside them. Ingest Sentinel incidents, query Sentinel and Defender data during investigation, act in Defender, and write status and closure back to Sentinel so the customer’s view stays current.
- Be multi-tenant by design. One workspace per customer, data and settings separated, analysts working across all of them from one interface.
- Investigate before assignment. Timeline, affected entities and a root-cause narrative on the case before an analyst opens it.
- Let the MSSP set autonomy per customer, because customers differ in what they will allow the platform to do in their Defender tenant.
- Be approvable by regulated customers and host data in the EU.
Morpheus was the MSSP’s first full SOC automation platform. There was no runbook library to migrate; the decision was about what operations should look like from here.
How it is wired
Nothing was replaced. Sentinel and Defender XDR stay the detection layer and the system of record for their own data. Morpheus is where investigation, case handling and closure happen.
| Microsoft tool | Role in the service | What Morpheus does with it |
|---|---|---|
| Microsoft Sentinel | SIEM and primary incident source across customer tenants | Ingests incidents; runs investigation queries against Sentinel data; writes status, findings and closure back so the customer sees the same case state |
| Microsoft Defender XDR | Endpoint, identity and email detection | Pulls device, user and mailbox context during investigation; stages or runs containment (isolate device, disable account, purge mailbox) under the autonomy mode set for that customer |
| Microsoft Azure | Hosting | Morpheus is deployed on Azure with EU data residency; available through the Azure Marketplace and eligible for Azure committed spend |
One workspace per customer tenant
Each customer has its own workspace: separated data, playbooks, autonomy settings and reporting. An analyst moves between customers inside one interface rather than between portals. Onboarding a new Sentinel customer means connecting the tenant and applying the standard playbook set, then tuning autonomy for that customer.
Investigation across Sentinel and Defender together
Attack Path Discovery reads the Sentinel incident, then goes looking: Defender XDR for the device, user and mailbox, Sentinel for related activity across the tenant, the threat-intelligence feed for indicator context. It works backward to the entry point and forward to every user, device and account the activity touched. The result is one timeline and one entity graph, assembled from both Microsoft tools without an analyst choosing where to start.
Autonomy set per customer
Containment in Defender is where customers differ most. One customer wants every action staged for approval. Another has agreed to automatic isolation of a device for a defined set of alert types. Both run from the same playbooks; the autonomy mode in each workspace decides whether Morpheus proposes or acts. Every action is recorded either way.
Playbooks from prompts, maintained against change
Most workflows were created by describing the desired behaviour in plain language and letting Morpheus draft the playbook. The team reviews and approves it; after that it runs the same way every time. Morpheus also maintains playbooks and integrations against API and schema changes so they do not break quietly, which matters when one playbook set serves dozens of Sentinel tenants.
What changes for an analyst: a Sentinel phishing incident, start to finish
- The incident arrives and pre-processing runs first.
Triage and enrichment playbooks check it against known noise, existing controls and recent activity. Obvious false positives are dispositioned and logged. Nothing reaches a queue yet.
- Attack Path Discovery investigates.
Morpheus searches the customer’s Sentinel and Defender data for the sender, recipients, subject, related devices and any downstream clicks, downloads or process activity. Backward to the entry point, forward to everything affected.
- The case is written up before anyone opens it.
The analyst sees an AI summary that separates what Sentinel detected from what Morpheus found in Defender and elsewhere, a chronological timeline, an entity graph, and a priority score built on impact, confidence and existing controls.
- The analyst decides.
Mailbox purge, account lock or device isolation are staged for approval, or already executed if that customer’s autonomy mode allows it. Either way, every step is in the audit trail.
- Closure is drafted, not typed.
The AI summary produces the closure note and remediation guidance. The analyst edits and approves. Sentinel and the ticketing system update, and the customer sees a complete record.
“The investigations are accurate and they save time. The AI summary is very helpful.”
SOC team, European MSSP, during production onboarding (condensed from recorded sessions)
The part that does not change: the analyst is still the one who decides what happens in a customer’s Defender tenant. Morpheus arrives with the evidence. It does not replace the judgement.
Results
- Dozens of tenants in production Daily triage for those customers runs in their Morpheus workspaces, with Sentinel and Defender XDR connected and the remainder of the base being onboarded.
- Portal switching removed Analysts work every customer from one interface. Context arrives on the case rather than living in whichever console was open.
- Noise handled before assignment Pre-processing playbooks disposition obvious false positives and log them. What reaches a queue has already been investigated.
- Critical incidents actionable inside the SLA Investigation depth is tuned to severity so critical alerts land with evidence and a recommended action inside the MSSP’s 15-minute commitment.
Work in progress: bringing user-reported phishing into the same investigation path, tightening critical-alert turnaround with a lighter investigation mode on the newest release, and expanding per-customer reporting on time to assignment and time to resolution.
Why this matters for any MSSP on the Microsoft stack
Standardizing on Sentinel and Defender XDR is the right call for detection, and it is the stack most MSSPs are already on. The cost shows up after the incident fires: investigation, case handling and closure, done by hand, multiplied by every tenant. An agentic SOC layer that reads from both Microsoft tools, investigates before a person opens the case, acts in Defender under per-customer rules, and writes back to Sentinel is what turns one detection standard into one operating model.
D3 Security is a Microsoft Intelligent Security Association member. Morpheus deploys on Azure, is available through the Azure Marketplace, and can be purchased with Azure committed spend, which keeps procurement inside the Microsoft relationship the MSSP and its customers already have.
Frequently asked questions
Does an agentic SOC platform replace Microsoft Sentinel?
No. Sentinel and Defender XDR stay as the detection layer for every customer tenant. Morpheus ingests Sentinel incidents, runs the investigation across Sentinel and Defender data, handles the case, and writes status and closure back to Sentinel. Each Microsoft tool remains the system of record for its own data.
How does an MSSP run one SOC across many Microsoft Sentinel tenants?
Each customer tenant maps to its own workspace in Morpheus, with separated data, playbooks, autonomy settings and reporting. Analysts move between customers inside one interface instead of switching portals. Onboarding a new Sentinel customer means connecting the tenant and applying the standard playbook set.
What does Morpheus do with a Defender XDR alert that Sentinel alone does not?
Sentinel correlates and raises the incident. Morpheus investigates it: device, user and mailbox context from Defender XDR, related activity from Sentinel, backward to the entry point and forward to everything affected, written up as a timeline, an entity graph and a root-cause narrative before an analyst opens the case. Containment actions in Defender are staged or run under the autonomy mode set for that customer.
Can the MSSP use Sentinel automation rules and playbooks alongside Morpheus?
Yes. Sentinel keeps its analytics rules and any automation already in place. Morpheus adds the investigation layer and multi-tenant case handling on top. In this deployment most workflows were created in Morpheus from plain-language prompts, reviewed and approved, then run deterministically.
Is D3 Morpheus a Microsoft partner product?
D3 Security is a member of the Microsoft Intelligent Security Association (MISA). Morpheus deploys on Microsoft Azure, is available through the Azure Marketplace, and is eligible for purchase with Azure committed spend.
What results did the MSSP see?
Dozens of customer tenants in production with daily triage running in their Morpheus workspaces, portal switching removed from the analyst workflow, noise handled before assignment, and investigation depth tuned so critical incidents are actionable inside the MSSP’s 15-minute commitment.
Related case studies
Related reading on D3Security.com
About D3 Security
D3 Security builds D3 Morpheus, the agentic SOC platform that investigates and responds to security alerts autonomously. Morpheus connects to the SIEM, EDR, XDR, identity and cloud tools an organization already runs, investigates every alert with Attack Path Discovery, and executes response through deterministic playbooks under a human-set autonomy mode. It is used by enterprise SOC teams, MSSPs and MDR providers that need to scale investigation without scaling headcount, and deploys in cloud, on-premises, hybrid, sovereign-region and air-gapped environments.
Customer details in this case study are anonymized at the customer’s request. Figures are the customer’s own, from its evaluation and production records. Request a demo or read the D3 glossary of agentic SOC terms.
Canonical URL: https://d3security.com/resources/mssp-microsoft-sentinel-defender-agentic-soc/
Running Sentinel and Defender for more than one customer?
See Morpheus investigate a Sentinel incident across Defender data, write the case up, and hand it back to Sentinel, on your own tenants. A working session with a D3 engineer, not a slide deck.