What is the difference between Microsoft Sentinel and Microsoft Defender?

Microsoft Defender XDR is an endpoint-to-cloud detection and response platform focused on Microsoft's own security signals (endpoints, identities, email, cloud apps).

Microsoft Sentinel is a SIEM that ingests logs and signals from any source, including third-party tools like Cisco, AWS, Splunk, and SAP, and applies AI-driven analytics across your entire environment. Since 2025, both platforms have been unified in the Microsoft Defender portal, but they serve distinct, complementary roles. Most enterprise environments benefit from both. Learn more about Microsoft Sentinel in this article.