Microsoft Security Partner
Microsoft Security MDR
Agentic SOC for Microsoft

Microsoft Tender Questions for SOC and MDR

Peer Review

Gartner brand name text logo in white with registered trademark symbol.
5-star rating
4.8

Proven Trust

Dark blue circle with two overlapping checkmarks, one green and one light blue.
ISO 27001 text with a globe outline symbol on a black background.
2025 winner badge for Cyber Security Excellence Awards with gold and black design.
Trusted Microsoft Solutions Partner for Security

The questions to ask suppliers when you buy a managed SOC or MDR service on Microsoft, and why each one matters. Then let us tailor them to your industry, Microsoft environment and culture.

Request tailored questionsDownload the free guide

13

tender guide sections

141

numbered tender questions

22

pricing schedule lines
By now, most organisations have already
suffered significant business impact.
Talk to us about your exposure
WHAT'S INSIDE THE GUIDE

What You'll Take Away

The guide has 141 questions across 13 sections, each with a short reason it matters. They cover company credentials, pricing and contract terms, service experience, incident response, SOC operations, threat intelligence, onboarding, exit, AI, the Microsoft Sentinel and Defender platform, and service governance.

You’ll find questions on who can act during an incident, how price changes as log volume grows, what AI does automatically, and what it costs to leave.
WHAT WE TAILOR

One List Doesn't Fit Every Organisation. We Adapt it to Yours

Your industry

Regulatory and compliance questions that match your sector.

Your Microsoft environment

Sentinel, Defender, licensing and log volumes, as you run them.

Your culture

How you work with suppliers, and what a good partner looks like to you.
QUESTIONS FROM THE GUIDE

Six Questions From the Guide

2. Commercial, contractual and legal
Question 2.6
Which costs are set by Microsoft and which by you? Do you add a margin to Microsoft charges, and who holds the billing relationship?
Why it matters: shows which costs Microsoft sets and which the provider sets.
Question 2.8
What would you charge for our current scope, and how would the price change if our log volume rose by 50% or 100%?
Why it matters: shows how cost scales over the life of the contract.
3. Partnership and service experience
Question 3.2
Which people would be named and dedicated to us, and which would come from a shared pool?
Why it matters: confirms you will work with people who know your environment.
Question 3.4
If we made no contact for a month, what proactive contact would we receive?
Why it matters: tests how proactive the service really is.
5. Incident management and response
Question 5.9
Which containment actions in Microsoft Defender and Sentinel are pre-authorised, which need our approval, and which are recommended only?
Why it matters: agreeing who can act in advance speeds containment.
6. Operating the SOC
Question 6.8
Who owns false-positive tuning, and is it included in the base fee?
Why it matters: a well-managed service gets more accurate over time.
ALL SECTIONS OF THE GUIDE

What's in the Guide

Company information
Commercial, contractual and legal
Partnership and service experience
Service requirements
Incident management and response
Operating the SOC
Threat intelligence and hunting
Onboarding and transition
Offboarding and handover
Additional services
AI-enabled SOC and Microsoft security
Microsoft Sentinel and Defender platform
Service governance
Pricing comparison schedule
CHOOSE WHAT YOU GET

Not Sure? Start with the Free Guide

The Full Guide

141 questions across 13 sections
A reason beside every question
The 22-line pricing schedule
Download the free guide

Tailored to Your Organisation

MDR FOR MICROSOFT SECURITY

What to Ask Before Choosing an MDR for Microsoft

How can we prove Microsoft expertise?

The Microsoft credentials and integrations behind our detection and response.
See Our Partnership →

Need Microsoft Security expertise?

Our analysts monitor and respond across your Microsoft stack around the clock.
See Microsoft MDR →

How does the SOC actually Respond?

How automated triage and analyst-led investigation work together across your Microsoft environment.
See the Agentic SOC →