Try our new research platform with insights from 80,000+ expert users

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Microsoft Sentinel is praised for its seamless integration with other Microsoft products, enhancing its functionality and ease of use.
The AI and machine learning features are valuable, offering strong capabilities in threat detection and analysis.
Sentinel provides powerful automation with Azure Logic Apps, allowing for efficient incident response.
The ability to correlate data from multiple sources significantly enhances threat detection capabilities.
With built-in SOAR capabilities, Sentinel minimizes the need for additional licensed solutions, boosting cost efficiency.

CONS

Microsoft Sentinel needs more out-of-the-box connectors for seamless integration with various on-premise and third-party systems.
The integration with other SaaS providers and security vendors can be improved to eliminate the need for log normalization.
There are challenges with ingesting Azure services from different tenants without losing metadata, which should be addressed.
Learning KQL is necessary for fully utilizing Microsoft Sentinel's functionalities, posing a steep learning curve for some users.
The pricing model is complex and inconsistent, making cost estimation difficult for clients, particularly concerning AI and automation features.
 

Microsoft Sentinel Pros review quotes

MD
CEO at Danastar Professional Services, LLC
Jan 23, 2021
We have no complaints about the features or functionality.
reviewer1404306 - PeerSpot reviewer
SOC Analyst at a wholesaler/distributor with 10,001+ employees
Feb 12, 2021
The pricing of the product is excellent.
reviewer1342566 - PeerSpot reviewer
System Engineer at a tech vendor with 5,001-10,000 employees
Feb 24, 2021
In Azure Sentinel, we have found, they do have a store in their capability. AI and intelligence features. We found that to be very helpful for us because some other things we do need to integrate again or find another vendor for the store
Learn what your peers think about Microsoft Sentinel. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
879,768 professionals have used our research since 2012.
reviewer1537419 - PeerSpot reviewer
Domain Architect at a government with 5,001-10,000 employees
Apr 12, 2021
Free ingestion for Azure logs (with E5 licence)
SI
Principal Cloud Architect at Viria Security Oy
Jun 3, 2021
The UI-based analytics are excellent.
reviewer1604991 - PeerSpot reviewer
Senior Microsoft 365 Consultant at The Collective Consulting
Jul 12, 2021
Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents.
reviewer1655235 - PeerSpot reviewer
Director - Technology Risk & Cyber at a financial services firm with 10,001+ employees
Aug 23, 2021
It is quite efficient. It helps our clients in identifying their security issues and respond quickly. Our clients want to automate incident response and all those things.
GO
Information Security Lead at Enerjisa Üretim
Oct 12, 2021
It is always correlating to IOCs for normal attacks, using Azure-related resources. For example, if any illegitimate IP starts unusual activity on our Azure firewall, then it automatically generates an alarm for us.
SM
Lead Azure Sentinel Architect at a financial services firm with 10,001+ employees
Oct 14, 2021
The most valuable feature is the performance because unlike legacy SIEMs that were on-premises, it does not require as much maintenance.
reviewer1681203 - PeerSpot reviewer
Sr. Microsoft Solutions Specialist at a tech vendor with 1,001-5,000 employees
Oct 15, 2021
One of the most valuable features is that it creates a kind of a single pane of glass for organizations that already use Microsoft software. So, when they have things like Microsoft 365, it is very easy for them to kind of plug in or enroll those endpoints into the Azure Sentinel service.
 

Microsoft Sentinel Cons review quotes

MD
CEO at Danastar Professional Services, LLC
Jan 23, 2021
I would like to be able to monitor applications outside of the Azure Cloud.
reviewer1404306 - PeerSpot reviewer
SOC Analyst at a wholesaler/distributor with 10,001+ employees
Feb 12, 2021
The interface could be more user-friendly. It''s a small improvement that they could make if they wanted to.
reviewer1342566 - PeerSpot reviewer
System Engineer at a tech vendor with 5,001-10,000 employees
Feb 24, 2021
They could use some kind of workbook. There is some limitation doing the editing and creating the workbook.
Learn what your peers think about Microsoft Sentinel. Get advice and tips from experienced pros sharing their opinions. Updated: December 2025.
879,768 professionals have used our research since 2012.
reviewer1537419 - PeerSpot reviewer
Domain Architect at a government with 5,001-10,000 employees
Apr 12, 2021
They should integrate it with many other software-as-a-service providers and make connectors available so that you don't have to do any sort of log normalization.
SI
Principal Cloud Architect at Viria Security Oy
Jun 3, 2021
The on-prem log sources still require a lot of development.
reviewer1604991 - PeerSpot reviewer
Senior Microsoft 365 Consultant at The Collective Consulting
Jul 12, 2021
The solution should allow for a streamlined CI/CD procedure.
reviewer1655235 - PeerSpot reviewer
Director - Technology Risk & Cyber at a financial services firm with 10,001+ employees
Aug 23, 2021
Its documentation is not so simple. It is easy for somebody who is Microsoft certified or more closely attached to Microsoft solutions. It is not easy for those who are working on open-source platforms. There isn't a central point where everything is documented, and there is no specific training or certification.
GO
Information Security Lead at Enerjisa Üretim
Oct 12, 2021
They need to work with other security vendors. For example, we replaced our email gateway with Symantec, but we couldn't collect these logs with Azure Sentinel. Instead of collecting these logs with Azure Sentinel, we are collecting them on Qradar. We couldn't do it with Sentinel, which is a problem for us.
SM
Lead Azure Sentinel Architect at a financial services firm with 10,001+ employees
Oct 14, 2021
If Azure Sentinel had the ability to ingest Azure services from different tenants into another tenant that was hosting Azure Sentinel, and not lose any metadata, that would be a huge benefit to a lot of companies.
reviewer1681203 - PeerSpot reviewer
Sr. Microsoft Solutions Specialist at a tech vendor with 1,001-5,000 employees
Oct 15, 2021
I can't think of anything other than just getting the name out there. I think a lot of customers don't fully understand the full capabilities of Azure Sentinel yet. It is kind of like when they're first starting to use Azure, it might not be something they first think about. So, they should just kind of get to the point where it is more widely used.