The unified security operations platform

On Monday, October 19, 2026, Ama Boateng sat down for her first shift beside Nadia Okonjo, the security operations lead Harrow & Finch hired in September from a managed detection and response provider. Ama had spent a year on Sunil Rao's team doing a little of everything: password resets, phishing reports, the occasional firewall rule. Sunil now wanted a proper security operations function, and he wanted Ama to grow into its first full-time analyst. The plan was simple: twice a week until mid-November, Ama would shadow Nadia through real queues, and in between she would study for the SC-200 Microsoft Security Operations Analyst exam, which she plans to sit in September 2027 after the SC-900 exam she has booked for February.

Nadia started by asking a question she would repeat for the next four weeks: "What did the attacker touch, and what can they still touch?" Everything a security operations center does, she said, is in service of answering that question quickly and accurately. Tools matter because they decide how fast you can answer it. This lesson describes the toolset Harrow & Finch uses, how its parts fit together, and how the SC-200 exam frames the job.

What a security operations analyst does

A security operations analyst watches for signs of attack, decides which signs matter, investigates them, and takes or recommends action to stop the harm and recover. The work falls into a few repeating activities. Triage is deciding what to look at first. Investigation is working out what happened, to which accounts, devices, mailboxes and applications, and in what order. Response is containing the attacker and removing their footholds. Hunting is looking proactively for attacks that no alert has caught. Improvement is tuning detections and automation so the next incident is caught sooner and handled with less effort.

Microsoft's SC-200 study guide groups the skills into three areas. Managing a security operations environment, which covers configuring automation, the Microsoft Sentinel platform, data ingestion and detections, carries the most weight at 40 to 45 parts in 100 of the exam. Responding to security incidents carries 35 to 40, and performing threat hunting 20 to 25. The guide on Microsoft Learn lists skills measured as of October 21, 2026, with a passing score of 700. This course covers the Defender XDR side of that outline; MSAZ-341 covers Microsoft Sentinel, MSAZ-342 hunting with KQL and incident management, and MSAZ-349 reviews the whole outline for the exam.

Extended detection and response

Endpoint detection and response, or EDR, collects detailed activity from computers and servers, detects suspicious behavior and lets analysts respond on the device. Extended detection and response, or XDR, applies the same idea across more domains: email and collaboration, identities, cloud applications and cloud workloads. The value is correlation. A phishing message, a risky sign-in, a new inbox rule and an unusual file download are four separate warnings in four separate tools; in an XDR product they become one incident with one story.

Microsoft Defender XDR is Microsoft's XDR suite. It brings together several products that can also be described on their own. Defender for Endpoint protects Windows, macOS, Linux, Android and iOS devices and servers. Defender for Office 365 protects Exchange Online mail and Teams, SharePoint and OneDrive content. Defender for Identity watches on-premises Active Directory and related identity infrastructure. Defender for Cloud Apps discovers and controls software-as-a-service applications. Microsoft Entra ID Protection contributes identity risk signals, Microsoft Purview contributes data loss prevention and insider risk alerts, and Defender for Cloud contributes alerts from Azure, other clouds and on-premises servers it protects. Each product has its own sensors and settings; the Defender portal is where their alerts, incidents and investigations come together.

The unified security operations platform

For several years Microsoft Sentinel, the cloud security information and event management (SIEM) product, lived in the Azure portal while Defender XDR lived in the Defender portal. Analysts switched tabs, and incidents existed twice. Microsoft has since merged them into what it calls the unified security operations platform: Sentinel workspaces are connected to the Defender portal, incidents and alerts from both appear in one queue, advanced hunting can query Defender tables and Sentinel tables together, and automation, threat intelligence and exposure management sit alongside. Microsoft announced that the Sentinel experience in the Azure portal will be retired, and in early 2026 it moved that date to March 31, 2027, so every Sentinel customer will be working in the Defender portal by then.

Harrow & Finch made the choice early. When Sunil's team set up Sentinel in November 2026, as SC-900's course MSAZ-131 described, they connected the workspace to the Defender portal from the first day, so Ama has never had to learn the old Azure portal screens. Nadia was firm about why: a single queue means one place to triage, one incident number to quote, and one set of comments and tasks for each case. She has seen teams lose hours because an analyst closed an incident in one portal while another was still working the same attack in the other.

Licensing and what Harrow & Finch has

Which features a tenant can use depends on licenses, and the exam expects candidates to know the broad shape rather than prices. Defender for Endpoint comes in Plan 1, which gives next-generation antivirus, attack surface reduction and device control, and Plan 2, which adds EDR, automated investigation, advanced hunting and threat analytics. Defender for Office 365 Plan 1 adds Safe Links, Safe Attachments and stronger anti-phishing to the built-in Exchange Online Protection; Plan 2 adds Threat Explorer, automated investigation and response for email, attack simulation training and more. Microsoft 365 E5 includes the Plan 2 versions of both, plus Defender for Identity and Defender for Cloud Apps. License bundles change, so Nadia keeps a one-page table of what the company actually owns and checks it each renewal.

Harrow & Finch owns Microsoft 365 E5 for 320 head office staff, store managers and IT staff, and Microsoft 365 F3 for the rest of the store workforce, who use shared till PCs and their own phones for scheduling. The company's 412 Windows laptops and desktops, its 140 store till PCs and its 38 on-premises servers are covered by Defender for Endpoint through the E5 licenses and server licenses bought with Defender for Cloud. That coverage plan is the subject of lesson 3.

Security Copilot in the portal

Microsoft Security Copilot is a generative AI assistant for security work. It appears embedded in the Defender portal as incident summaries, guided response suggestions, explanations of scripts and command lines, and help writing hunting queries, and it also has a standalone portal and agents that run tasks such as triaging user-reported phishing. Microsoft began including Security Copilot with Microsoft 365 E5 and E7 from November 18, 2025, rolling it out over the following months. The inclusion page on Microsoft Learn describes a monthly allocation of Security Compute Units, or SCUs, of 400 for every 1,000 paid user licenses, scaled down for smaller tenants and capped at 10,000 a month, resetting each month with no rollover. Those numbers may change, so treat the worked figures below as an example of how the allocation scales.

seats = 320                    # Microsoft 365 E5 users at Harrow & Finch
per_thousand = 400             # SCUs per 1,000 paid user seats each month
cap = 10_000                   # monthly maximum

monthly = min(cap, seats * per_thousand / 1000)
print(f"Monthly allocation: {monthly:.0f} SCUs")

# Nadia's rough budget: incident summaries and guided response on busy days
summaries_per_day = 12
scu_per_summary = 0.4          # illustrative planning figure, not a published rate
days = 30
use = summaries_per_day * scu_per_summary * days
print(f"Planned use: {use:.0f} SCUs, about {use / monthly * 100:.0f} in every 100 of the allocation")

Monthly allocation: 128 SCUs
Planned use: 144 SCUs, about 113 in every 100 of the allocation

The result made Nadia rethink her plan. With 128 SCUs a month, Security Copilot is for the incidents that need it, not for summarizing every low-severity alert. She set a rule for the team: use the embedded summary on any incident rated medium or higher that involves more than one product, and use script analysis whenever a command line looks obfuscated. Everything else is read by a person first. Microsoft has said that usage above the allocation will be throttled at a future date and that customers will then be able to pay for more; the team will watch the usage dashboard each month.

Roles and access in the Defender portal

Who can see and do what in the portal is controlled by Microsoft Defender XDR unified role-based access control, which replaced the separate permission models of each product. Administrators create custom roles from permission groups such as security operations, security posture and authorization and settings, and assign them to users or groups, optionally scoped to particular data sources or device groups. Microsoft Entra built-in roles such as Security Reader, Security Operator and Security Administrator still apply as well.

Harrow & Finch created three roles. Analysts, including Ama, can read all security data, manage incidents and alerts, and take response actions such as isolating a device or running an antivirus scan, but cannot change settings. Responders, Nadia and Sunil, can also approve pending remediation actions and run live response with unsigned scripts. Administrators, Sunil and Renata Kowal from the cloud team, manage settings and onboarding. Store support technicians get a narrow role limited to the Stores device group, so they can see the health of the till PCs without seeing head office investigations.

Where the data lives

When a tenant first sets up Defender for Endpoint or Defender XDR, it chooses a data storage location, and that choice cannot be changed later without starting again. Harrow & Finch chose the United States, where its Azure resources and Microsoft 365 data already live. Raw device telemetry is kept for a limited period and queried through advanced hunting, which covers roughly the last 30 days for Defender tables; longer retention comes from sending data to a Sentinel workspace or its data lake, which MSAZ-341 covers. Carmen Ortiz, the privacy officer, asked for one more control: investigation packages and files collected from devices are handled as Confidential under the company's labels, because they can contain personal information.

The real case turned out to be harmless: the laptop was slow because of a stuck update. But Nadia made Ama walk through the steps anyway, because the habit of checking scope is what separates a closed ticket from a contained incident. The rest of this course follows the platform in the same order: incidents and alerts (lesson 2), each Defender product in turn (lessons 3 to 7 and 10), automation (lesson 8), threat intelligence and vulnerability management (lesson 9), attack disruption (lesson 11), and a full multi-stage incident from November 3, 2026 (lesson 12).