MDR CompaniesManaged detection & response, compared

Compare · Microsoft stack · checked 2026-11-08

MDR on Microsoft Defender

In brief

Microsoft sells its own MDR, Microsoft Defender Experts MDR. 15 other providers on this board say their service runs on Defender for Endpoint, and 9 say they work in Microsoft Sentinel. Which fits depends on whether you want Microsoft’s own team or a provider that also covers non-Microsoft tools.

01

Microsoft’s own: Defender Experts

Microsoft Defender Experts MDR (Plan 1 and Plan 2; Plan 1 formerly Defender Experts for XDR) and Microsoft Defender Experts Hunting (formerly Defender Experts for Hunting); also sold within the Microsoft Defender Experts Suite

Triage, investigation and managed response on Microsoft Defender incidents; with the security operator role analysts “can also take specific remediation actions agreed upon with your SOC team”; for Plan 2 third-party sources, response guidance only.

  • Plan 1 covers Microsoft Defender workloads only; Plan 2 (needs Microsoft Sentinel and at least 1,500 seats) adds Okta, Proofpoint TAP, AWS CloudTrail, AWS GuardDuty, Palo Alto PAN-OS, Cisco ASA/Meraki, Zscaler ZIA/ZPA and Fortinet FortiGate.
  • For third-party sources Microsoft analysts give response guidance but do not act inside the third-party product.
  • The service covers High and Medium severity incidents on Windows, Linux and macOS; iOS, Android, IoT, DLP and custom detections are out of scope, and neither plan covers Defender for Cloud workloads.
  • Defender Experts MDR is not available in GCC High, DoD or sovereign clouds; a Plan 1 for Gov service is offered to GCC customers who do not require FedRAMP authorization.

MXDR. Microsoft, a vendor that sells it: “Like MDR, MXDR is a managed service that combines tech solutions with human expertise. However, with MXDR, the provider uses XDR security solutions to extend protection across a wider variety of IT environments.” (source).

EDR vendor’s MDRM·26

Microsoft

Microsoft Defender Experts MDR (Plan 1 and Plan 2; Plan 1 formerly Defender Experts for XDR) and Microsoft Defender Experts Hunting (formerly Defender Experts for Hunting); also sold within the Microsoft Defender Experts Suite · Customers with constrained SOCs overburdened with alert volume, needing skilled experts, or both (Defender Experts Hunting is for customers with a robust SOC)

Ownership
Public (NASDAQ: MSFT)
HQ, founded
Redmond, Washington, US · 1975
Tools
Its own stack. Deploys its own agent or platform. Own technology: Microsoft Defender XDR (Defender for Endpoint P2, Defender for Office 365 P2, Defender for Identity, Defender for Cloud Apps), Microsoft Entra ID P2; Microsoft Sentinel for Plan 2. EDRs named: its own Microsoft Defender for Endpoint. SIEM: Plan 1 uses Microsoft Defender data; Plan 2 operates on the customer’s own Microsoft Sentinel workspace (Microsoft says it is not a managed SIEM service) Source
Response
Triage, investigation and managed response on Microsoft Defender incidents; with the security operator role analysts “can also take specific remediation actions agreed upon with your SOC team”; for Plan 2 third-party sources, response guidance only. Incident response: Not included: Defender Experts MDR “doesn’t provide incident response services for an active compromise”; incident response is the separate Microsoft Defender Experts Cybersecurity Incident Response service. Source
Service level
No response time stated
24/7 human analysts, stated.
Price
Not published.
Attestations
None found for this service on its public pages.
Demo, sample
None public.
MITRE eval
Took part in MITRE ATT&CK Evaluations, Managed Services: OilRig (2022); menuPass + ALPHV BlackCat (2024). MITRE publishes results, not scores.

NoteMicrosoft disclosed in an SEC filing that a nation-state actor accessed and exfiltrated information from a small percentage of Microsoft corporate email accounts, including senior leadership and cybersecurity staff, between late November 2023 and January 2024. Source

PTRSADChecked 2026-11-08 · 11 sources: microsoft.com, learn.microsoft.com
02

15 providers that run on Defender for Endpoint

Providers that name Microsoft Defender for Endpoint among the EDRs their service works on, in board order. If part of your estate isn't on Microsoft, check that the provider covers it too.

MDR providers that run on Microsoft Defender for Endpoint
ProviderWorks in SentinelContains for youService levelPublished price
Rapid7Rapid7 MDR: Managed Threat Complete (Essential, Advanced, Ultimate tiers); also sold as Rapid7 MDR for Microsoft and MDR for Enterprise. Legacy MDR Essentials and MDR Elite continue for existing customers.Own platformStatedObjective: start investigating critical alerts within 15 minutesFrom $73,000 a year, Essential tier from 300 assets (its AWS listing)
Arctic WolfAurora Managed Detection and Response (Arctic Wolf MDR); Aurora MDR Connect (MDR tier for MSPs)Own platformStatedNo figure. FAQ: contacts you “within minutes” of a threat$44,000 a year, MDR Basic for up to 100 users (its AWS listing)
Binary DefenseBinary Defense Managed Detection and Response (also referenced as MDR, MDR Plus, MDR+, MDR Core); BDVision managed EDR as an add-onStatedStatedContractual: critical alerts within 30 minutes, high within 4 hours$136,842 for 36 months, managed EDR for 5,000 endpoints (its AWS…
eSentireeSentire MDR (Atlas Professional, Atlas Enhanced and Atlas Elite packages)StatedStatedStated average: 15 minutes to contain$17, $24 or $28 per user a month (10–100 users), plus $2,500 a year
ExpelExpel Managed Detection and Response (MDR)StatedStatedNo SLA. Stated averages: 13 min to respond, 14 min to remediate (high and critical)$88,800 a year for 500 cloud-resource units (its AWS listing)
Red Canary (Zscaler)Zscaler Managed Detection & Response (MDR), formerly Red Canary MDRStatedStatedNo SLA. Stated: 2-minute median to acknowledge high-severity threats$120 per endpoint, 12-month contract (its AWS listing)
SophosSophos Managed Detection and Response: Sophos MDR and Sophos MDR Plus (MDR Plus formerly MDR Complete)Own platformStatedMDR Plus, contractual: respond within 60 minutes for 90% of priority cases$239.64 a year per unit, workstation MDR (its AWS listing; the unit…
Blackpoint CyberBlackpoint MDR (CompassOne MDR), including Managed EDR and Cloud MDROwn platformStatedStated average: under 15 minutes to contain live threatsNot published
BlueVoyantBlueVoyant Managed Detection & Response: MDR for Microsoft (Defender XDR and/or Sentinel), MDR for Cisco XDR, MDR / MXDR for SplunkStatedNot statedStated average: under 15 minutes to identify$73,872 a year, MDR for Splunk; “price will depend on scope” (its AWS…
Critical StartCritical Start Managed Detection and Response (MDR), in Essentials, Enterprise and Signature tiersStatedStatedContractual: 60-minute mean time to respond, with service creditsNot published
DeepwatchDeepwatch Managed Detection and Response (Deepwatch Guardian MDR Platform); Managed Endpoint Detection and Response (MEDR)StatedStatedNot stated$245,198 a year: MDR with Splunk licensing, 50 GB a day (its AWS…
OntinueOntinue ION MXDR (also called MXDR Core) and Ontinue MXDR Essentials (launched November 3, 2026), both for Microsoft Security environmentsStatedStatedContractual: critical-attack response triggered within 15 minutes, with creditsNot published
Secureworks (Sophos Taegis)Taegis MDR (formerly Taegis ManagedXDR), with Taegis MDR Plus, Taegis MDR Enhanced and Taegis MDR for OT; now sold by SophosOwn platformStatedContractual: under 60 minutes from case to notification, with creditsNot published
Trustwave (LevelBlue)LevelBlue Managed Detection & Response (MDR and MDR Elite; formerly Trustwave MDR). Related: LevelBlue MXDR and Co-Managed SOCStatedStatedMDR Elite: 15-min acknowledge, under 30-min respond (in its SOW)Not published
Mandiant (Google Cloud)Mandiant Managed Defense (Managed Defense for Google SecOps; Managed Defense Standard)Own platformStatedNo response-time SLA; 99.9% portal availability is contractualNot published

From each provider’s own integrations pages, linked from its entry on the provider board. The full EDR matrix is on MDR vs EDR vs XDR. Checked November 8, 2026.

Running Defender already?

Tell us your licences (E3, E5, Business Premium), your endpoint count and whether you use Sentinel. We reply by email with the providers that fit.

We only pass your details to a provider if you ask us to.

Get a shortlist
03

Questions

What is MXDR?

Managed extended detection and response: a provider runs and watches an XDR platform for you and responds. Microsoft uses the term for managed services on its own Defender and Sentinel stack. On this board, BlueVoyant, Ontinue, Trustwave (LevelBlue), Todyl use the name.

Does Microsoft sell its own MDR?

Yes: Microsoft Defender Experts MDR, in two plans, plus Defender Experts Hunting. Microsoft does not publish a price for it on the pages we checked.

Which MDR providers work with Microsoft Defender for Endpoint?

15 of the 27 providers on this board name Defender for Endpoint as an EDR their service runs on: Rapid7, Arctic Wolf, Binary Defense, eSentire, Expel, Red Canary (Zscaler), Sophos, Blackpoint Cyber, BlueVoyant, Critical Start, Deepwatch, Ontinue, Secureworks (Sophos Taegis), Trustwave (LevelBlue), Mandiant (Google Cloud).

Do I need Microsoft Sentinel for MDR on Defender?

Not necessarily. Some providers work from Defender’s own portal; others run their SOC in your Sentinel workspace (9 on this board say so) or bring their own platform and pull Defender data into it.

04 · sources

Sources for this page

  1. Microsoft: Microsoft Defender Experts MDR (Plan 1 and Plan 2; Plan 1 formerly Defender Experts for XDR) and Microsoft Defender Experts Hunting (formerly Defender Experts for Hunting); also sold within the Microsoft Defender Experts Suite — What Defender Experts includes, and its price where published.
  2. Microsoft, a vendor that sells it: Managed extended detection and response (MXDR) — The definition of MXDR quoted above.
  3. Each provider’s own integrations pages — Which providers run on Defender for Endpoint and in Sentinel.

Each provider’s own sources are linked from its entry on the provider board. How providers are chosen and ordered, and how to correct an entry: methodology.

Cite this page

MDR Companies. “MDR on Microsoft Defender: Defender Experts and providers.” Updated November 8, 2026. https://mdrcompanies.com/microsoft-defender-mdr/