What BT actually announced
BT is launching a new Security Operations Centre-as-a-Service (SOCaaS) for Microsoft Sentinel, using its security operations expertise to deliver cyber defence in a single managed service. It is described as a UK-managed service that combines Sentinel with BT's security operations expertise, threat intelligence and experience. It builds on BT's existing role as a managed security provider for Sentinel.
BT's service page describes SOCaaS as a fully managed service. It says the service provides 24/7 monitoring, threat detection and incident response, and aims to reduce the burden on internal teams.
Trade press coverage so far mostly repeats BT's own framing. Mobile World Live, for example, notes that BT positioned the offering as helping customers cut the complexity of security operations, control costs and "improve detection, response and resilience".
This is not BT's first Sentinel service. SecurityBrief reported years ago that BT had launched managed security and advisory services for Azure Sentinel, billed as the first in a series of managed security services for Microsoft's cloud-based applications. Sentinel has since been renamed and has changed a great deal, so the new service is better read as a repackaging and relaunch than a first entry.
The claims, and how to weigh them
BT makes several claims:
- It says it blocks around four million attempted cyber-attacks every day and protects more businesses than any other network.
- It says that, unlike other providers, it combines Sentinel, managed operations, threat intelligence and UK cyber expertise in one service.
- It cites Microsoft's Digital Defense Report 2026 for the claim that the average time from vulnerability discovery to weaponisation has fallen well below 24 hours.
These are vendor claims. The announcement gives no measurement method for the four million figure and names no competitors. It publishes no detection or response metrics. I could not open the Microsoft report itself during research, so the "below 24 hours" figure is BT's citation of Microsoft and I have not verified it independently.
The announcement also does not state pricing, contract terms, service-level targets, data-location specifics, onboarding steps or customer names. None of those should be assumed.
Sentinel context: what the platform does and what BT adds
Microsoft's documentation describes Sentinel as a cloud-native SIEM. It says Sentinel is also a platform for security orchestration, automation and response (SOAR). Microsoft's current overview describes 350+ out-of-the-box data connectors, covering first- and third-party security products and cloud platforms. It also describes a data lake tier for long-term retention and a hosted MCP server for agent-style tooling.
Sentinel is the technology. A managed SOC supplies the people and process around it: triage, investigation, tuning and response. Microsoft's automation documentation says automation rules and playbooks are meant to handle recurring enrichment, response and remediation work. Playbooks are built on Azure Logic Apps.
Microsoft also documents Azure Lighthouse support, which lets service providers manage subscriptions and resource groups that customers delegate to them. That is a general Sentinel capability. BT has not said how it will access customer environments.
The deadline that matters more than the press release
Microsoft states that after March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Microsoft also says Sentinel is available in the Defender portal even for customers without Defender XDR or an E5 license.
For a managed service, that transition has practical consequences. Microsoft's automation page lists differences after onboarding to the Defender portal:
- Automation rules with alert triggers act only on Sentinel alerts unless you use the enhanced alert trigger.
- Incident names can change because of the Defender portal's correlation engine.
- The SecurityIncident table loses its Description field, which can break automation rules and ticketing integrations that depend on it.
- Running playbooks manually on an alert or an entity is not currently supported in the Defender portal.
- Automation rules can take up to 10 minutes to run after an incident is created or updated.
None of this is specific to BT. It is exactly the sort of detail to ask any provider about, because it affects how automated response behaves in practice.
Questions to put to BT (or any Sentinel MSSP) before signing
These are procurement questions prompted by the service model. They are not BT's announced terms.
- Scope of telemetry: Which log sources and environments are covered, and which connectors need extra setup or cost?
- Billing: Who pays for Sentinel ingestion and licensing, and how is the managed fee structured? BT promotes a single contract and bill, so ask what that covers.
- Authority: Can the provider isolate devices or disable accounts, or does it only escalate to your team? Who approves containment?
- Hours and targets: What are the triage, escalation and response-time commitments in writing?
- Retention and location: How long is data kept, in which tier, and where?
- Integration: How does the service fit with existing tooling such as ticketing systems?
- Portal transition: How will the provider handle the Defender portal move before 31 March 2027, including automation rules?
- Exit: Who owns the detection rules, playbooks and workbooks if you leave?
Analysis
The strategic logic is sound. Many organisations buy Sentinel, then struggle to staff 24/7 monitoring and keep detections tuned. A UK-based managed option from a large telco will appeal to public sector buyers, who tend to want a single accountable supplier. Microsoft's UK chief executive is quoted in the announcement, which signals that Microsoft supports the offering.
There are counterpoints. "Managed" does not mean "outsourced accountability". Your organisation still owns its data, its identities and its incident decisions. Sentinel costs can climb with ingestion volume, so a single bill could hide where the money goes. And "unlike other providers" is marketing language, not a tested comparison. Many other Microsoft partners also offer managed Sentinel services.
Bottom line
BT's SOCaaS for Microsoft Sentinel is a real UK launch from a major provider, with a real platform behind it. The announcement does not yet give the detail needed to judge it. Until pricing, response commitments and the Defender portal transition plan are in writing, treat it as a credible option to evaluate rather than a proven solution.