Microsoft Sentinel Deployment Guide
End-to-end guide for Sentinel workspace architecture, data connector selection, analytics rules, and cost optimisation.
Security engineers and MSSPs standing up Microsoft Sentinel for the first time or rescoping an existing deployment.
A field-tested Sentinel deployment guide covering workspace design choices, connector prioritisation, analytics rule tuning, and the cost controls that actually matter once the workspace is humming.
1. Workspace architecture
Decide early whether you are running a single-tenant, single-workspace model or a hub-and-spoke. Single workspace is simpler and cheaper; multi-workspace is required for data sovereignty, tenant separation, or when multiple business units have different retention requirements. Cross-workspace queries are possible but add latency and complexity.
2. Data connector prioritisation
Do not enable every connector on day one. Order by value-per-GB.
- Tier 1 (enable immediately): Azure Activity, Microsoft Entra Sign-in + Audit, Microsoft 365 Defender, Office 365, Defender for Cloud
- Tier 2 (enable week 2): Azure Firewall, Azure WAF, AWS CloudTrail or GCP Audit (if multi-cloud)
- Tier 3 (selective): Syslog/CEF from network appliances, DNS logs, Windows Security Events (only specific event IDs via DCR)
- Avoid until justified: full verbose Windows Event Forwarding, unfiltered firewall flow logs, IIS logs
3. Analytics rule tuning
- Enable the Microsoft Sentinel content hub solutions that match your connectors
- Start with Microsoft-provided rules in alert-only mode for two weeks
- Review noise daily in the first fortnight — suppress or tune every rule that fires more than 3x/day without a genuine incident
- Create scheduled queries for the detections your content hub does not cover (industry-specific)
- Map every active rule to a MITRE ATT&CK technique — rules without a tactic usually indicate unclear detection intent
4. Cost controls
Sentinel costs are dominated by ingestion volume. These controls give the largest reductions.
- Use Data Collection Rules (DCRs) to filter Windows Security Events to only the IDs you need — typically cuts volume 70%+
- Use Basic Logs tier for high-volume, low-analytic-value sources (firewall, NetFlow)
- Move data older than 90 days to archive tier — kept for investigation without hot query cost
- Drop columns you never query using transformation KQL at ingestion time
- Commitment tiers (100 GB/day+) reduce per-GB cost by 15–60% once you know your baseline
5. Operational handover checklist
- Incident response runbooks exist for the top 10 alert types
- On-call rota is documented and tested
- Weekly false-positive review is scheduled
- Monthly rule coverage review against MITRE ATT&CK is in place
- Quarterly connector + workspace health review is diarised
CyberZonic runs engagements that turn material like this into evidence.
If you need help scoping the work, turning this into a project plan, or running the assessment itself, get in touch.