No more typing reviews! Try our Samantha, our new voice AI agent.

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Microsoft Sentinel offers seamless integration with other Microsoft products, enhancing security capabilities and providing a unified set of tools for detecting, investigating, and responding to incidents.
Its automation and threat intelligence features significantly reduce human workload, making threat management more efficient and less stressful.
The cost-effectiveness of Microsoft Sentinel allows organizations to access a robust security analytics platform without large upfront expenses, making it accessible to a wider range of customers.
Microsoft Sentinel's machine learning and AI capabilities provide advanced threat detection and analysis, improving security posture with minimal manual intervention.
The ability to correlate data from various sources enhances threat detection, offering proactive security measures and faster response to incidents.

CONS

Azure Sentinel faces challenges with integration and compatibility with third-party tools and non-Microsoft products.
The playbook development environment in Azure Sentinel is not as rich or user-friendly as required, making the creation and implementation process cumbersome.
Azure Sentinel's cost structure, based on data ingestion, is perceived as high, prompting concerns regarding its affordability compared to other traditional SIEM solutions.
There are issues with delays in data ingestion and false positives, leading to inefficiencies and potential misinterpretations of threat alerts.
Documentation and training for Azure Sentinel, particularly regarding Kusto Query Language (KQL), are perceived as inadequate, with a significant learning curve for users unfamiliar with the system.
 

Microsoft Sentinel Pros review quotes

MD
CEO at Danastar Professional Services, LLC
Jan 23, 2021
We have no complaints about the features or functionality.
reviewer1404306 - PeerSpot reviewer
SOC Analyst at a wholesaler/distributor with 10,001+ employees
Feb 12, 2021
The pricing of the product is excellent.
reviewer1342566 - PeerSpot reviewer
System Engineer at a tech vendor with 5,001-10,000 employees
Feb 24, 2021
In Azure Sentinel, we have found, they do have a store in their capability. AI and intelligence features. We found that to be very helpful for us because some other things we do need to integrate again or find another vendor for the store
Learn what your peers think about Microsoft Sentinel. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
886,976 professionals have used our research since 2012.
reviewer1537419 - PeerSpot reviewer
Domain Architect at a government with 5,001-10,000 employees
Apr 12, 2021
Free ingestion for Azure logs (with E5 licence)
SI
Principal Cloud Architect at Viria Security Oy
Jun 3, 2021
The UI-based analytics are excellent.
it_user1604991 - PeerSpot reviewer
Senior Microsoft 365 Consultant at The Collective Consulting
Jul 12, 2021
Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents.
reviewer1655235 - PeerSpot reviewer
Director - Technology Risk & Cyber at a financial services firm with 10,001+ employees
Aug 23, 2021
It is quite efficient. It helps our clients in identifying their security issues and respond quickly. Our clients want to automate incident response and all those things.
it_user1691883 - PeerSpot reviewer
Information Security Lead at Enerjisa Üretim
Oct 12, 2021
It is always correlating to IOCs for normal attacks, using Azure-related resources. For example, if any illegitimate IP starts unusual activity on our Azure firewall, then it automatically generates an alarm for us.
SM
Lead Azure Sentinel Architect at a financial services firm with 10,001+ employees
Oct 14, 2021
The most valuable feature is the performance because unlike legacy SIEMs that were on-premises, it does not require as much maintenance.
reviewer1681203 - PeerSpot reviewer
Sr. Microsoft Solutions Specialist at a tech vendor with 1,001-5,000 employees
Oct 15, 2021
One of the most valuable features is that it creates a kind of a single pane of glass for organizations that already use Microsoft software. So, when they have things like Microsoft 365, it is very easy for them to kind of plug in or enroll those endpoints into the Azure Sentinel service.
 

Microsoft Sentinel Cons review quotes

MD
CEO at Danastar Professional Services, LLC
Jan 23, 2021
I would like to be able to monitor applications outside of the Azure Cloud.
reviewer1404306 - PeerSpot reviewer
SOC Analyst at a wholesaler/distributor with 10,001+ employees
Feb 12, 2021
The interface could be more user-friendly. It''s a small improvement that they could make if they wanted to.
reviewer1342566 - PeerSpot reviewer
System Engineer at a tech vendor with 5,001-10,000 employees
Feb 24, 2021
They could use some kind of workbook. There is some limitation doing the editing and creating the workbook.
Learn what your peers think about Microsoft Sentinel. Get advice and tips from experienced pros sharing their opinions. Updated: April 2026.
886,976 professionals have used our research since 2012.
reviewer1537419 - PeerSpot reviewer
Domain Architect at a government with 5,001-10,000 employees
Apr 12, 2021
They should integrate it with many other software-as-a-service providers and make connectors available so that you don't have to do any sort of log normalization.
SI
Principal Cloud Architect at Viria Security Oy
Jun 3, 2021
The on-prem log sources still require a lot of development.
it_user1604991 - PeerSpot reviewer
Senior Microsoft 365 Consultant at The Collective Consulting
Jul 12, 2021
The solution should allow for a streamlined CI/CD procedure.
reviewer1655235 - PeerSpot reviewer
Director - Technology Risk & Cyber at a financial services firm with 10,001+ employees
Aug 23, 2021
Its documentation is not so simple. It is easy for somebody who is Microsoft certified or more closely attached to Microsoft solutions. It is not easy for those who are working on open-source platforms. There isn't a central point where everything is documented, and there is no specific training or certification.
it_user1691883 - PeerSpot reviewer
Information Security Lead at Enerjisa Üretim
Oct 12, 2021
They need to work with other security vendors. For example, we replaced our email gateway with Symantec, but we couldn't collect these logs with Azure Sentinel. Instead of collecting these logs with Azure Sentinel, we are collecting them on Qradar. We couldn't do it with Sentinel, which is a problem for us.
SM
Lead Azure Sentinel Architect at a financial services firm with 10,001+ employees
Oct 14, 2021
If Azure Sentinel had the ability to ingest Azure services from different tenants into another tenant that was hosting Azure Sentinel, and not lose any metadata, that would be a huge benefit to a lot of companies.
reviewer1681203 - PeerSpot reviewer
Sr. Microsoft Solutions Specialist at a tech vendor with 1,001-5,000 employees
Oct 15, 2021
I can't think of anything other than just getting the name out there. I think a lot of customers don't fully understand the full capabilities of Azure Sentinel yet. It is kind of like when they're first starting to use Azure, it might not be something they first think about. So, they should just kind of get to the point where it is more widely used.