A risky AI use alert gets an owner
The sample response names who reviews and who may act.
Coming
See every demonstrationFREE CHECK
Cloud security check
Connect access, telemetry, and response ownership across the Microsoft estate.
01 Source02 Boundary03 Human decision04 Evidence
WHAT TO REVIEW
Four questions for the team that owns the decision.
- Are privileged roles reviewed and time bounded?
- Do endpoint and cloud alerts reach an accountable responder?
- Is the containment approval path documented?
- Can recovery be tested without production disruption?
Take the PDF with you.
Enter a work email, company and role to request the PDF. This action records an SIT inquiry for follow-up. Marketing emails require a separate choice.
Download the PDF directlyTHE CHECK
What does the cloud security check test?
Whether privileged roles are reviewed and time bounded, whether endpoint and cloud alerts reach an accountable responder, whether the containment approval path is documented, and whether recovery can be tested without disrupting production.
Four questions on access, telemetry and response ownership across the Microsoft estate, with a PDF you can download directly and no email required.
THE MICROSOFT INSIGHT
What date should already be on the security calendar?
March 31, 2027: after that date Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal.
After March 31, 2027, Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal. (Microsoft Learn, checked Oct 31, 2026)
Plan the portal move now and it is a change window. Discover it later and it is an outage of your own making.
THE METHOD
How does the check become an authority matrix?
Each answer names a person and a limit: who holds privilege and for how long, who receives the alert, who approves containment, and who can test recovery.
- Privilege: roles reviewed on a date and time bounded.
- Alerts: endpoint and cloud signals reach a named responder, not a mailbox.
- Containment: the approval path is written, including who acts at 2 a.m.
- Recovery: tested without production disruption, on a schedule.
THE LICENSE
What is already in your E5 that nobody switched on?
Often Microsoft Security Copilot, included for eligible Microsoft 365 E5 and E7 customers, rolling out in phases since November 18, 2025.
Microsoft Security Copilot is included for eligible Microsoft 365 E5 and E7 customers; the rollout started November 18, 2025 and continues in phases. (Microsoft Learn, checked Oct 31, 2026)
Activate what the license includes and the budget line is operating effort. Buy beside it and you pay twice.
THE NEXT RUNG
What comes after the check?
A read-only security assessment that tests the four answers inside your tenant, then managed security under the authority matrix you sign.
The assessment is scoped separately from the service and quoted after a scoping call. Microsoft-funded where you qualify.
AFTER TWO WEEKS
What will be working after two weeks?
- You hold the PDF and the four answers are marked tested or assumed.
- The privileged roles without a review date are listed.
- The alerts that reach a mailbox instead of a person are named.
- You have booked, or decided not to book, the read-only assessment.
HONEST ABOUT LIMITS
What this does not do yet
It does not assume a SIEM feature that is still in preview. ISOC in Microsoft Defender, in preview, brings SIEM capabilities into the Defender portal for eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel workspace, with 30 days of included retention for Defender data during this preview phase. (Microsoft Learn, checked Oct 31, 2026, preview) The question about alerts is answered with the controls that are fully released today.
It does not test recovery: the check asks whether it can be tested, the assessment runs the test.
It does not create a lead unless you ask for the PDF by email and say so.
THE ONE THING TO REMEMBER
Privilege, alerts, containment, recovery: four answers that name a person and a limit.
Said another way: an alert that reaches a mailbox has not reached anyone.
Said a third way: decide in advance who may act, so nobody decides alone at 2 a.m.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
Is the PDF gated?
No. Download it directly. Asking for it by email is optional and creates an inquiry; marketing email is a separate box.
What is an authority matrix?
A written table of who may take which security action, under what conditions, and who is told. It is drafted from the four answers and signed before any managed service starts.
Do we need to move Microsoft Sentinel?
After March 31, 2027 it is available only in the Microsoft Defender portal. The assessment puts the move on the calendar with its own change window.
What comes after the check?
A read-only security assessment inside your tenant, then managed security under the authority matrix you sign.
How is the assessment priced?
Quoted after a scoping call, scoped separately from the managed service. Microsoft-funded where you qualify.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.