What was announced
Ontinue announced MXDR Essentials on November 3, 2026, from Zürich. It describes the service as built to extend Microsoft's ISOC into 24/7 managed security operations. The company says the service focuses on operationalizing Microsoft Defender with continuous investigation and response.
The company describes it as an entry-level option. It is meant for organizations that want round-the-clock coverage of their core Defender environment but don't need the broader telemetry or advanced capabilities of a full MXDR service. Ontinue says the service covers endpoints, servers, email and identities, using Defender controls already deployed in the customer's tenant.
The announcement names the suite, not individual products. Actual coverage will depend on which Defender components you have deployed. That is the first thing to confirm in any sales conversation.
The Microsoft foundation underneath
Microsoft announced ISOC in Defender on September 23, 2026. Its blog post describes a foundation that brings SIEM and threat protection together so that people and agents share signals, context and controls. Ontinue's September blog noted that ISOC was in preview for eligible organizations without an active Microsoft Sentinel workspace.
Microsoft's eligibility FAQ sets the ISOC boundaries:
- An active Microsoft Defender Suite, Microsoft 365 E5 or E7 license, plus an Azure subscription.
- No minimum seat count for eligible E5 and E7 customers.
- Security mini suites, standalone security suites, and Education and Frontline SKUs are excluded.
- Existing Sentinel customers see no change. They can choose to move to ISOC starting November 15, 2026, if they meet the licensing criteria.
These are Microsoft's ISOC requirements. Ontinue's announcement doesn't spell out the commercial or licensing prerequisites for MXDR Essentials, so don't assume the two lists are the same.
Data retention is also worth watching. Ontinue's September post said that during the preview, eligible customers get 30 days of included Defender data retention. Microsoft's current ISOC page refers to a 90-day data benefit. I can't tell from the evidence whether that reflects a change since the preview. Check the current terms for your tenant.
How the service works
Ontinue's platform, called ION SecOps, automates triage, enrichment, investigation and containment actions. Ontinue's human Cyber Defenders take over incidents that need deeper analysis, judgment or customer involvement.
Rules of Engagement are the most operationally interesting part. Customers define:
- which actions Ontinue may take immediately,
- when customer approval is required,
- who gets involved, and
- how incidents escalate.
So automated response is governed by customer-set permissions, not described as unrestricted. The announcement doesn't list specific response actions or default rules. Those are exactly what a prospective buyer should ask about.
Other features:
- Teams collaboration: incident discussion with Ontinue specialists happens in Microsoft Teams. The announcement doesn't say whether Teams is mandatory.
- Posture recommendations: operational findings become prioritized Security Posture Improvement recommendations. How they are prioritized isn't explained.
- ISOC Deployment Package: this is a separate aid for configuring telemetry, integrations and automation. Ontinue's earlier blog says it helps organizations move from platform activation to an operational environment. No pricing or timeline is given.
Essentials versus MXDR Core
| MXDR Essentials | MXDR Core | |
|---|---|---|
| Scope | Core Microsoft Defender signals | Broader telemetry coverage |
| Sentinel management | Not included | Included |
| Detections | Not stated as customized | Tailored detections |
| Threat hunting | Not stated | Proactive hunting |
| Advisory | Not stated | Designated advisory support |
| Platform and SOC | ION SecOps, 24/7 Cyber Defense Center | Same |
Ontinue says the shared platform lets customers move up without changing providers. Its CEO, Moritz Mann, framed the idea in the announcement: security operations shouldn't be an all-or-nothing decision.
Ontinue's earlier blog also said existing ION MXDR customers need take no action, and that their agreements and service delivery stay unchanged.
What to weigh
In its favor: Many mid-sized Microsoft shops own E5 and still can't staff a night shift. A narrower managed layer over Defender is a plausible fit. Ontinue also says its engineers worked with Microsoft's product group before the ISOC announcement.
Caveats:
- The announcement gives no pricing, no service-level commitments, no customer examples and no measured response-time results. The claim that the platform reduces the time between detection and response is the vendor's own.
- Working with Microsoft's product group is not a Microsoft endorsement or certification. Microsoft doesn't run this service.
- Narrower telemetry means narrower evidence. Ontinue's own blog warns that cutting telemetry for cost reasons can limit what analysts can reconstruct during an incident. That argument also applies to choosing the cheaper tier.
- ISOC is still new. Its capabilities and availability may change, and your managed layer inherits that churn.
Questions to ask before buying
- Which Defender products and data sources in my tenant are actually covered?
- Which response actions can be pre-approved, and which always need my sign-off?
- How are incidents escalated, and to whom, outside business hours?
- What are the licensing prerequisites beyond ISOC eligibility?
- At what point would I need Core, such as for Sentinel, third-party logs, hunting or custom detections?
- What are the contractual response commitments?
Timing
Ontinue says it will show the service at Microsoft Ignite. It lists a session called "Accelerate Your Security Services at Machine Speed" (BRK495) on Thursday, November 19, at 9:00 a.m. in Moscone South, Level 2, Room 211. It also lists booth 5165L. These are the company's own schedule details.
Bottom line
MXDR Essentials is a sensible packaging move for the ISOC era: Microsoft supplies the integrated tooling and Ontinue supplies the people and the automation to run it. The details that matter most are still unpublished: price, default rules of engagement, performance commitments and onboarding requirements. Until Ontinue publishes them, treat the announcement as a starting point for vendor questions, not a verdict on the service.