How does Datadog defend against Microsoft Sentinel + Azure Monitor in 2027?

The procurement meeting where the bundle argument lands

Picture a 3,000-employee software company running roughly 60% of its production workload on AWS, 30% on Azure, and 10% on-premises. Engineering standardized on Datadog three years ago. Then the Microsoft enterprise agreement comes up for renewal, the account team walks in with an E5 uplift proposal, and someone in finance asks the question that starts every one of these deals: "If Sentinel and Defender come with E5, and Azure Monitor is already inside our Azure consumption, why are we paying a separate observability bill?"

That question is not unreasonable and it is not easily answered with a feature comparison. Microsoft 365 E5 lists at roughly $57 per user per month, and Sentinel plus Defender XDR ride along inside that license envelope. Azure Monitor, Application Insights, and Log Analytics bill against Azure consumption, which the company has already committed to under an Azure consumption commitment. Microsoft Defender for Cloud's CSPM tier attaches to the subscription itself. From the CFO's seat, the Microsoft security and observability stack looks like a sunk cost and Datadog looks like an incremental line item.

The trap for a Datadog seller — and for the internal champion trying to defend the tool — is to respond by listing features. Feature lists lose this argument because Microsoft has an answer for every individual box. Sentinel has a SIEM. Azure Monitor has APM. Log Analytics has log search with KQL. Defender for Cloud has CSPM and workload protection. Purview covers data governance and compliance, and Fabric increasingly overlaps the analytics surface. On a checklist, parity is close enough that the free-with-E5 column wins.

The argument that actually works reframes the comparison from *tool cost* to *total operational cost across the whole estate*. In this example company, 60% of production runs somewhere Microsoft's tooling is a second-class citizen. Whatever Sentinel and Azure Monitor cover natively in Azure, the AWS and on-prem workloads still need collection, correlation, and alerting. If the answer is "we'll run Azure Monitor for Azure and something else for AWS," the company has just bought two observability stacks, two query languages, two alerting models, and two on-call runbooks — and the incident that spans both is the one that takes four hours instead of forty minutes. That is the defensible ground, and it is where every Datadog conversation against Microsoft should start.

The second reframe is about who actually decides. The E5 argument is made in procurement, but observability tooling is chosen by a VP of Engineering, a platform lead, or an SRE manager who will be paged at 3 a.m. by whatever gets deployed. A RevOps team supporting this motion should be wiring the deal desk to surface that split explicitly: which economic buyer signs, which technical buyer specifies, and which of the two the discount conversation needs to reach. Deals lost to the bundle are usually deals where the technical buyer never got a seat.

How the neutrality argument actually works in practice

The word "multi-cloud" is doing a lot of work in most competitive decks, so it is worth being concrete about the mechanism. Datadog's model is a single agent with a single configuration that runs identically on EC2, Azure VMs, GCE, bare metal, EKS, AKS, GKE, OpenShift, and self-managed Kubernetes. Metrics, traces, and logs land in one backend, get tagged with one tag schema, and are queried with one query language. The practical result is that a service map can span a workload split across two clouds without the operator having to context-switch between consoles.

Microsoft's model is architecturally different, and the difference is not accidental. Azure Monitor is built around Log Analytics workspaces, KQL, and resource-level diagnostic settings — a design that is extremely good inside Azure because it inherits Azure Resource Manager's identity, tagging, and scoping model for free. Extending that model outward requires connective tissue: Azure Arc to project non-Azure servers and Kubernetes clusters into ARM, and Sentinel data connectors to pull in AWS CloudTrail, GuardDuty, and third-party SaaS telemetry. Those connectors are real and they work, but they are a projection layer rather than a native substrate, and the fidelity is uneven — you generally get the security-relevant events well and the deep performance telemetry less well.

The consequence shows up in incident work. When a latency regression originates in an AWS-hosted service and manifests in an Azure-hosted API, the Datadog path is one distributed trace crossing the boundary. The split-stack path is a Log Analytics query, an export or a manual timestamp correlation, and a second query in the AWS-side tool. That correlation tax is small on a good day and enormous during a real outage.

The second mechanism worth understanding is data gravity. An observability platform accumulates switching cost the way a CRM does — not through contracts but through artifacts. A mid-market Datadog deployment typically carries hundreds of custom dashboards, a monitor library with composite conditions and SLO burn-rate alerts, saved views, notebooks, and a tag taxonomy that half the engineering org has internalized. Migrating that is not a data export; it is a rewrite. Dashboards must be reauthored in KQL. Alerting logic that Datadog expresses as a composite monitor often needs to be reconstructed as multiple alert rules plus glue, sometimes an Azure Function, because Azure Monitor's alert rules are deliberately simpler in shape.

Historical retention compounds it. Anomaly detection and seasonal baselines are only as good as the history behind them, and rebuilding a year of baselines means running the new system in parallel long enough to accumulate them. That parallel-run period is the real migration cost, and it is paid in engineer-months, not license dollars. For a company on the fence, the honest framing is that switching to the "free" stack costs a two-quarter platform-engineering project plus a period of degraded detection quality — which is exactly the number that should be on the slide when procurement says free.

What the numbers actually support

Competitive arguments collapse when a number turns out to be invented, so it is worth separating what is publicly verifiable from what is estimation.

Verifiable, and useful. Microsoft Sentinel became generally available in 2019 and Microsoft has publicly described security as a business exceeding $20 billion in annual revenue as of fiscal 2024 — that figure spans the whole security portfolio, not Sentinel alone, and should be cited that way. Datadog is a public company; revenue, customer counts, and the customers-above-$100K and above-$1M cohorts are disclosed quarterly in its filings and shareholder letters, and those are the numbers to quote rather than any secondhand summary. Microsoft 365 E5 pricing is published on Microsoft's own pricing pages. Azure Monitor and Log Analytics pricing — ingestion per GB, commitment tiers, and retention beyond the included window — is published and changes periodically, so pull it live rather than from a deck.

Directionally reliable but should be attributed as estimates. Cloud infrastructure market share is tracked by analyst firms including Synergy Research and Canalys, and the consistent shape across quarters is AWS in the low thirties, Azure in the low-to-mid twenties, and Google Cloud around ten percent. Flexera's annual State of the Cloud report has for several years put the share of enterprises using more than one cloud in the high sixties to seventies. Those are the two numbers most worth having in the room, because together they establish that the median enterprise is not an Azure monoculture — which is the entire premise of the neutrality argument.

Do not quote as fact. Sentinel-specific or Defender-specific revenue splits are not broken out by Microsoft. Any "Sentinel is a $5–7B business" figure is an analyst estimate, and presenting it as a Microsoft number is exactly the kind of error that costs credibility mid-deal. The same applies to precise product-launch cadence comparisons; "Datadog ships a large batch of GA and preview launches around its DASH conference each year" is defensible, a specific launches-per-year ratio against Microsoft is not.

The number that actually moves deals is the customer's own. Build the comparison from their bill, not from market data. The inputs are: total daily log ingestion in GB split by cloud; how much of that is security-relevant versus operational; required hot retention versus archive; host and container counts by environment; and current spend on any tool that would be displaced. Azure Monitor and Sentinel both price primarily on ingested volume with commitment tiers that discount at higher daily volumes, so a high-ingestion shop's "free with E5" often is not free at all once Log Analytics ingestion is counted — Sentinel's analytics capability rides on E5, but the data still lands in a workspace that bills per GB. Surfacing that single distinction reframes more deals than any feature slide.

Two other quantities belong in the model. First, tool-count reduction: consolidating separate infrastructure monitoring, APM, log management, RUM, synthetics, and cloud security tooling into one platform removes not just licenses but integration work and per-tool administration. Second, mean time to resolution — if the customer measures MTTR, the cross-cloud correlation argument becomes a number instead of an assertion. If they don't measure it, offering to help instrument it during a trial is itself a wedge.

Where the trade-offs genuinely favor Microsoft

An honest defense names the cases it loses, because a seller who claims to win everywhere gets discounted on everything they say afterward.

Azure-only estates with a large enterprise agreement. If essentially all compute is Azure, the org is E5-licensed, and there is a large Azure consumption commitment in place, the Microsoft stack is the rational choice. The bundle economics are real, the integration with Entra ID and Azure RBAC is native, Defender for Cloud's posture management attaches at the subscription level, and the incremental value of neutrality is close to zero because there is nothing to be neutral about. The right play in these accounts is to stop competing on the platform and compete on specific gaps if any exist — otherwise deprioritize and spend the coverage somewhere winnable. Getting that segmentation into the CRM as a real field, so forecast quality reflects it, is a RevOps problem more than a sales one.

Microsoft-native security operations. A SOC whose identity, endpoint, email, and cloud signals all originate in Microsoft products gets genuine correlation value from Defender XDR feeding Sentinel. Incident-level correlation across Entra ID sign-ins, Defender for Endpoint detections, and Defender for Office 365 is a first-party advantage nobody else can fully reproduce, because the signals are generated by the same products doing the enforcement.

Compliance and data residency shaped around Azure. Where a regulator or a customer contract effectively requires data to stay inside a specific Azure boundary, keeping telemetry in a Log Analytics workspace in-region is architecturally simpler than negotiating a third-party processor.

The alternatives that are not Microsoft. The competitive frame is rarely binary. Open-source and OpenTelemetry-centric stacks — collector plus a metrics backend plus a log store plus a trace store — are a real option for teams with platform engineering capacity, trading license spend for headcount and operational ownership. Grafana-centered stacks occupy similar ground. Splunk remains entrenched in security-first organizations with mature detection engineering, and in those accounts the contest is often Datadog Cloud SIEM against Splunk rather than against Sentinel. Elastic competes on cost-per-GB in log-heavy environments. Naming these accurately in a competitive conversation is a credibility move: the customer already knows they exist.

Where OpenTelemetry cuts both ways. Broad OTel adoption lowers instrumentation switching costs for everyone, which erodes one component of Datadog's lock-in — the proprietary-tracer argument. It also erodes Microsoft's, and it makes the comparison land on backend quality, query experience, and correlation rather than on who owns the SDK. On balance it favors whichever vendor has the better analysis layer, which is an argument Datadog is generally willing to have.

Pitfalls that lose these deals

Arguing price against a bundle. The bundle cannot be beaten on headline price and attempting it trains the customer to evaluate on price alone. Price flexibility belongs in the deal, but as a closing instrument — marketplace private offers so spend draws down an existing cloud commitment, multi-year commit tiers, ramped commitments for growing estates — not as the opening argument. The opening argument is operational cost across the whole estate.

Quoting numbers that cannot be sourced. Sentinel-specific revenue, invented customer counts, precise ship-cadence ratios. One challenged number and everything else gets re-litigated. Bring the customer's own bill instead.

Ignoring that Microsoft's multi-cloud story keeps improving. Azure Arc and Sentinel's data connectors are genuinely better every year. A defense built on "Microsoft can't see AWS" ages badly and will be contradicted in the room. The durable version is architectural: Azure Monitor's model is anchored to ARM and Log Analytics workspaces by design, so non-Azure coverage is a projection, and projections lag natives. That framing survives the next product release; "they can't do it" does not.

Letting the evaluation be scoped as SIEM-versus-SIEM. Compared narrowly on Azure-native SIEM depth, Sentinel is very strong. Compared as "unified telemetry across the estate, with security signals correlated against the same traces and logs your engineers already use," the frame favors the platform. Scope the bake-off around a real cross-cloud incident, not a detection-rule checklist.

Underestimating the migration when it runs the other way. Teams that switch *to* Datadog face the mirror image of the switching cost described earlier, and pretending otherwise poisons the first ninety days. Plan the parallel run, budget the dashboard and alert reauthoring explicitly, and stage the cutover by workload rather than flipping the estate at once. A deal won on an unrealistic migration estimate churns at renewal.

Missing the reseller and integrator dynamic. Microsoft's field and partner channel is enormous and structurally biased toward Microsoft answers. Cloud marketplace listings on AWS and Google Cloud, where spend can count against an existing cloud commitment, plus system integrator practices that earn services margin on implementation, are the practical counterweight. If those motions are not instrumented — marketplace-sourced pipeline tracked separately, partner-influenced deals attributed, private-offer approval times measured — the counter-channel exists on paper but not in the forecast.

Treating "we're a Microsoft shop" as a disqualification. Very few enterprises are actually Azure monocultures. The right next question is what fraction of production compute is non-Azure, how much Kubernetes is running and where, and who gets paged. The answers usually reopen the conversation — and in the accounts where they don't, the disciplined move is to disqualify early and redeploy the coverage.

Related questions

Does Datadog have a real SIEM, or is Cloud SIEM a checkbox?

Datadog Cloud SIEM is a genuine product with detection rules, signal correlation, and investigation workflows, and its differentiator is that security signals sit alongside the same logs and traces engineering already uses. Against Sentinel's Azure-native depth it competes on unification and cross-cloud reach rather than on Azure-specific integration.

Can Datadog monitor Azure services as well as Azure Monitor does?

Datadog has deep Azure integrations covering VMs, AKS, App Service, SQL Database, and most major services, often with richer dashboarding and alerting. Azure Monitor retains tighter native hooks into certain PaaS diagnostics because it is part of the platform. For Azure-only estates the gap narrows considerably.

How should a seller respond when the customer says Sentinel is free with E5?

Separate the license from the data. Sentinel's analytics ride on E5, but ingestion still bills per GB against a Log Analytics workspace. Model their actual daily volume, add the non-Azure estate that E5 does not cover, and compare total operational cost rather than headline license price.

Does OpenTelemetry adoption help or hurt Datadog against Microsoft?

Both, roughly symmetrically. OTel lowers instrumentation switching costs in every direction, which weakens tracer-level lock-in but moves the decision onto backend analysis quality, query experience, and correlation depth — where a purpose-built observability platform generally prefers to compete.

What should a RevOps team instrument to track this competitive motion?

Add a competitor field that distinguishes Microsoft-bundle losses from feature losses, track marketplace-sourced and partner-influenced pipeline separately, measure private-offer approval cycle time, and segment accounts by estate composition so forecast quality reflects which deals are genuinely winnable.

FAQ

Is Datadog actually losing enterprise deals to Microsoft Sentinel?

It loses a specific profile: Azure-concentrated organizations with E5 licensing and a large Microsoft enterprise agreement, where the bundle economics are decisive and neutrality has little practical value. In multi-cloud, Kubernetes-heavy, and engineering-led organizations, the platform argument holds up well. The strategic error is treating the two segments identically.

Why does Microsoft's bundle create such a strong procurement pull?

Because it converts a new-spend decision into a no-new-spend decision. Sentinel and Defender XDR attach to E5, Azure Monitor bills against Azure consumption the customer has already committed, and Defender for Cloud attaches at the subscription. Procurement sees sunk cost versus incremental cost, which is the framing most favorable to Microsoft and least informative about total operational cost.

What is the strongest single argument against the bundle?

The portion of the estate the bundle does not cover well. If a meaningful share of production runs on AWS, GCP, or on-premises, the customer either buys a second stack for it or accepts reduced visibility there. Two stacks means two query languages, two alerting models, and two runbooks — and the cross-boundary incident is the expensive one.

How much does it actually cost to migrate off Datadog?

It is a platform-engineering project rather than a data export. Hundreds of dashboards get reauthored in KQL, composite and SLO burn-rate monitors get reconstructed, tag taxonomies get remapped, and historical baselines for anomaly detection have to re-accumulate during a parallel run. For a mid-market estate that is realistically a multi-quarter effort with a period of degraded detection quality.

Where should Datadog concede rather than compete?

Azure-only estates with E5 and a large consumption commitment, and Microsoft-native security operations where Defender XDR's first-party correlation across identity, endpoint, and email is the actual requirement. Competing there burns coverage capacity that converts better elsewhere. Encoding that judgment as a segmentation rule in the CRM is what turns it from an opinion into forecast accuracy.

Does Microsoft's improving multi-cloud support close the gap?

It narrows it and will keep narrowing it. Azure Arc and Sentinel's connectors are meaningfully better each year. The durable distinction is architectural rather than feature-level: Azure Monitor is anchored to Azure Resource Manager and Log Analytics workspaces by design, so non-Azure coverage is a projection layer, and projections trail native substrates in fidelity and latency.

Sources

• Microsoft Sentinel documentation: https://learn.microsoft.com/en-us/azure/sentinel/overview
• Azure Monitor overview: https://learn.microsoft.com/en-us/azure/azure-monitor/overview
• Azure Monitor and Log Analytics pricing: https://azure.microsoft.com/en-us/pricing/details/monitor/
• Microsoft Defender XDR documentation: https://learn.microsoft.com/en-us/defender-xdr/microsoft-365-defender
• Microsoft Defender for Cloud documentation: https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction
• Microsoft 365 enterprise plan pricing: https://www.microsoft.com/en-us/microsoft-365/enterprise/microsoft365-plans-and-pricing
• Datadog investor relations and SEC filings: https://investors.datadoghq.com/
• Datadog documentation and integrations: https://docs.datadoghq.com/
• Flexera State of the Cloud Report: https://www.flexera.com/blog/finops/cloud-computing-trends-flexera-state-of-the-cloud-report/
• OpenTelemetry project documentation: https://opentelemetry.io/docs/

Related on PULSE

• Will Datadog Cloud SIEM beat Splunk + Sentinel?
• How should a 2027 GTM team build a cloud marketplace motion on AWS Azure and GCP?
• How does ServiceNow defend against Microsoft Power Platform?
• How should Datadog price Bits AI against Microsoft Copilot in 2027?
• How should ServiceNow price Now Assist against Microsoft Copilot in 2027?
• How does Google Workspace compare to Microsoft 365 for collaboration?