Microsoft 365 Defender: Azure Sentinel integration

This demo introduces Azure Sentinel as a cloud-native SIEM for modern SecOps, then shows how to integrate it with Microsoft 365 Defender so Defender incidents flow straight into Sentinel—and stay synchronized. You’ll see the Microsoft 365 Defender data connector in Sentinel, including the recommendation to keep “Turn off all Microsoft incident creation rules for these products” enabled to prevent duplicate incidents, then the quick-click moment: Connect incidents & alerts. The video also covers ingesting advanced hunting events from Microsoft Defender for Endpoint (and other supported products), verifying ingestion using the connector’s data graph, and double-checking with a hunting query (for example, filtering events where the product name contains “Microsoft 365 Defender”). Once connected, incidents appear in the Sentinel incident queue with their alerts and entities, update as Defender enriches them, and bidirectional sync keeps assignment, status, and closing reason consistent in both portals—with deep links for fast back-and-forth investigation.

We produced this as a tight, no-fuss demo built to make an integration workflow feel refreshingly straightforward: we aligned on the key message, scripted the exact steps, and captured clean screens with professional voiceover and music that keeps the pace moving. In post, we trimmed distractions and emphasized the few settings that actually matter, so viewers can follow along once, repeat it confidently, and walk away remembering the “why” (one incident queue, fuller context) as clearly as the “how.” Final delivery includes closed captions, audio description, and thumbnails.