Investigate an incident and coordinate response
Review Defender incidents and alerts, investigate with scoped evidence, track incidents as requests, and isolate or release a device after setup.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Need a hands-on starting point?
Start with one tenant or talk to the team if you want help evaluating fit, permissions, or rollout approach.
Review the incident
TenantVigil ingests Microsoft 365 Defender incidents and alerts for consented customers. The Incidents page lists open incidents with severity and the Defender link.
The customer must have a licensed and available Defender service, and consent must include the incident-read permission. A customer that has not re-consented for that permission stays unread.
Investigate with scoped evidence
Analysts investigate incidents with the evidence their current role and Microsoft consent permit. Classified attachment metadata needs the customer's owner or admin and the additional Microsoft permissions; an MSP analyst does not inherit that classified access.
Record local triage in TenantVigil. It stays separate from the Defender incident state.
Coordinate response
Track an incident as an owned support request, notify the customer, and show the MSP's stated alert coverage. This is owned service work.
TenantVigil does not promise around-the-clock staffing, guaranteed alert latency or automatic incident resolution. The response time and staffing remain the MSP's own stated coverage.
Isolate or release a device
After Microsoft Defender setup, a technician can isolate a supported Defender device through the approved response path. Release is a separate approval.
Setup needs the Defender machine permissions, a registered callback and independent approval. Intune device IDs cannot stand in for Defender device IDs.
Next action
Plan and approve the change, or read the full containment boundary.
- Plan a change and read its receipt
- Supported changes and manual work