Microsoft Purview Data Loss Prevention vs Microsoft Sentinel comparison

Microsoft Purview Data Loss Prevention vs. Microsoft Sentinel

Download the complete report

Helped 832,723 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Microsoft Purview Data Loss...

Ranking in Microsoft Security Suite

13th

Average Rating

8.0

Reviews Sentiment

6.8

Number of Reviews

Ranking in other categories

Data Loss Prevention (DLP) (1st)

Microsoft Sentinel

Ranking in Microsoft Security Suite

5th

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Security Information and Event Management (SIEM) (3rd), Security Orchestration Automation and Response (SOAR) (1st), AI-Powered Cybersecurity Platforms (6th)

Mindshare comparison

As of February 2025, in the Microsoft Security Suite category, the mindshare of Microsoft Purview Data Loss Prevention is 2.6%, up from 2.1% compared to the previous year. The mindshare of Microsoft Sentinel is 5.3%, down from 6.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Microsoft Security Suite

Featured Reviews

Roby Skariah

Solution Architect : Corporate wide systems at a healthcare company with 10,001+ employees

Automation has given us consistent analytics and improved quality of insights into user activity

One of the valuable features of Purview is the ability to create a legal hold on a user's account within the compliance portal. That's pretty useful when it comes to any litigation or if you want to redeem the content within a mailbox, OneDrive, or a generic public SharePoint site. If you want to retain the user's data until the case is resolved, you can use the legal hold feature. Also, it's important that Purview can connect to iOS, Mac, and Android devices. With smartphone involvement, so many applications can now be accessed through them and it is important to apply Purview across operating systems and platforms. Purview's natively integrated compliance across Azure Dynamics and Office 365 is also significant because within Microsoft 365 there are multiple applications. Irrespective of whether it's Dynamics or Azure, it's very important that it has native support. The data connectivity should be efficient enough to support and secure their own platform's data. In addition, with varying regulations in different industries and matters, Purview lets you create rules and conditions based on industry standards around the world. That is important. Our company is in pharmaceuticals and the rules and conditions are different from other industries. It is important to be able to keep track of all these regulations and have a tool that is flexible enough to create the regulatory rules and conditions we need. And when it comes to data loss protection, Purview has features that can recognize patterns and detect any sort of data loss, where the data is being transferred from its platform to a different one. The default settings that come with it are pretty nice for identifying data transfer or data loss across the platform. It also comes with a lot of training materials, with use cases and examples, to help educate users and make them familiar with the tool.

Read full review

KrishnanKartik

Cyber Security Consultant at Inspira Enterprise

Every rule enriched at triggering stage, easing the job of SOC analyst

It's a Big Data security analytics platform. Among the unique features is the fact that it has built-in UEBA and analytical capabilities. It allows you to use the out-of-the-box machine learning and AI capabilities, but it also allows you to bring your own AI/ML, by bringing in your own IPs and allowing the platform to accept them and run that on top of it. In addition, the SOAR component is a pay-per-use model. Compared to any other product, where customization is not available, you can fine-tune the SOAR and you'll be charged only when your playbooks are triggered. That is the beauty of the solution because the SOAR is the costliest component in the market today. Other vendors charge heavily for the SOAR, but with Sentinel it is upside-down: the SOAR is the lowest-hanging fruit. It's the least costly and it delivers more value to the customer. The SOAR engine also uniquely helps us to automate most of the incidents with automated enrichment and that cuts out the L1 analyst work. And combining M365 with Sentinel, if you want to call it integration, takes just a few clicks: "next, next finish." If it is all M365-native, it is a maximum of three or four steps and you'll be able to ingest all the logs into Sentinel. That is true even with AWS or GCP because most of the connectors are already available out-of-the-box. You just click, put in your subscription details, include your IAM, and you are finished. Within five to six steps, you can integrate AWS workloads and the logs can be ingested into Sentinel. When it comes to a third party specifically, such as log sources in a data center or on-premises, we need a log collector so that the logs can be forwarded to the Sentinel platform. And when it comes to servers or something where there is an agent for Windows or Linux, the agent can collect the logs and ship them to the Sentinel platform. I don't see any difficulties in integrating any of the log sources, even to the extent of collecting IoT log sources. Microsoft Defender for Cloud has multiple components such as Defender for Servers, Defender for PaaS, and Defender for databases. For customers in Azure, there are a lot of use cases specific to protecting workloads and PaaS and SaaS in Azure and beyond Azure, if a customer also has on-premises locations. There is EDR for Windows and Linux servers, and it even protects different kinds of containers. With Defender for Cloud, all these sources can be seamlessly integrated and you can then track the security incidents in Microsoft's XDR platform. That means you have one more workspace, under Azure, not Defender for Cloud, where you can see the security incidents. In addition, it can be integrated with Sentinel for EDR deep-dive analytics. It can also protect workloads in AWS. We have customers for whom we are protecting their AWS workloads. Even EKS, Elastic Kubernetes Service, on AWS can be integrated, as can the GKE (Google Kubernetes Engine). And with Defender for Cloud, security alert ingestion is free

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The policy customization feature is very useful, and we have successfully used the auto policy configuration."

"The tool's most valuable feature is in the area of OCR."

"The solution's most valuable feature is the mature O365 DLP, which works with SharePoint and Teams."

"If we can prevent information from going out, eventually, when a regulator is asking about our security measures, we can show what we've been doing."

"I rate Microsoft Purview Data Loss Prevention's stability a ten out of ten."

"The solution's IDM (Indexed Document Matching), EDM (Exact Data Matching), and DCM (Described Content Matching) features have been most effective in identifying and mitigating potential data leaks."

"It's secure and can be integrated with an existing Forcepoint DLP setup."

"The product is easy to configure."

More Microsoft Purview Data Loss Prevention pros

"The native integration of the Microsoft security solution has been essential because it helps reduce some false positives, especially with some of the impossible travel rules that may be configured in Microsoft 365. For some organizations, that might be benign because they're using VPNs, etc."

"Azure Application Gateway makes things a lot easier. You can create dashboards, alert rules, hunting and custom queries, and functions with it."

"The log query feature has been the most valuable because it's very good. You can put your data on the cloud and run queues from Sentinel. It will do it all very fast. I love that I don't have to upload it to an Excel file and then manually look for a piece of information. Sentinel is much faster and is good for big databases."

"The standout feature of Sentinel is that, because it's cloud-based and because it's from Microsoft, it integrates really well with all the other Microsoft products. It's really simple to set up and get going."

"The UI of Sentinel is very good and easy to use, even for beginners."

"Native integration with Microsoft security products or other Microsoft software is also crucial. For example, we can integrate Sentinel with Office 365 with one click. Other integrations aren't as easy. Sometimes, we have to do it manually."

"Sentinel improved how we investigate incidents. We can create watchlists and update them to align with the latest threat intelligence. The information Microsoft provides enables us to understand thoroughly and improve as we go along. It allows us to provide monthly reports to our clients on their security posture."

"Another area where it is helping us is in creating a single dashboard for our environment. We can collect all the logs into a log analytics workset and run queries on top of it. We get all the results in the dashboard. Even a layman can understand this stuff. The way Microsoft presents it is really incredible."

More Microsoft Sentinel pros

Cons

"The scalability, in terms of the portal, could be more user-friendly. Sometimes I have faced difficulties in identifying the options."

"There is a lot of ambiguity when you are setting up labels, such as sensitive information labels. It is a little daunting at first if you don't have prior knowledge, and there is a little bit of a learning curve for setting up the labels. Some of the setup wizards could be more helpful from an AI perspective. They can streamline the setup through more AI technologies so that you don't have to jump through so many hoops and different menus and dropdowns. It would be useful to have a setup wizard that is more hands-off and engaging for setting up the information type labels. If you tell them this is what we're trying to protect, it should basically start to lead you down that path of best practices. Such a feature would be great."

"They do not provide language options beyond the ones already available, so our language option is missing."

"A major improvement is required in the solution's incident handling and alerting."

"It could cover more solutions and technologies."

"More training for end users on how it works would be beneficial."

"The tool's user interface and document fingerprinting have been very poor for my customers because uploading files manually can be problematic."

"There is a need for improvements, particularly in ensuring that file-based recognition is more reliable and comprehensive."

More Microsoft Purview Data Loss Prevention cons

"Microsoft Sentinel is relatively expensive, and its cost should be improved."

"The solution could improve the playbooks."

"They should just add more and more out-of-the-box connectors. It is quite a new product, and it has a lot of connectors, and even more would be good."

"It could have a better API to be able to automate many things more extensively and get more extensive data and more expensive deployment possibilities. It can gain some points on the automation part and the integration part. The API is very limited, and I would like to see it extended a bit more."

"There is room for improvement in terms of integrations. We have some tools, such as our off-site Meraki firewalls, that have not fully integrated with Sentinel. We lack integration for Syslogs into Sentinel."

"Improvement-wise, I would like to see more integration with third-party solutions or old-school antivirus products that have some kind of logging capability. I wouldn't mind having that exposed within Sentinel. We do have situations where certain companies have bought licensing or have made an investment in a product, and that product will be there for the next two or three years. To be able to view information from those legacy products would be great. We can then better leverage the Sentinel solution and its capabilities."

"The data connectors for third-party tools could be improved, as some aren't available in Sentinel. They need to be available in the data connector panel."

"When we pass KPIs to the governance department, there's no option to provide rights to the data or dashboard to colleagues. We can use Power BI for this, but it isn't easy or convenient. They should just come up with a way to provide limited role-based access to auditing personnel"

More Microsoft Sentinel cons

Pricing and Cost Advice

"The pricing is reasonable."

"Microsoft Purview Data Loss Prevention is part of a bundle and is not sold as a standalone product."

"Though I am not a specialist, the tool is quite expensive."

"The cost works out to about $15 per user per month."

"You get the solution in a bundle if you get the E5 suite."

"If one is very cheap and ten is very expensive, I rate the price as one out of ten."

"It is a part of our Microsoft licensing. We pay for a yearly renewal. Its price is reasonable for the size of the organization we are. It is fairly competitive, and you get what you pay for. We have an E5 license, and a part of understanding the E5 license is to see what all you get with it. If you really look at it from that standpoint, you get a lot of value. You have Defender and all its security features in there as well. Their licensing is fairly flexible. They have different programs. We've seen ones where you could pay for up to three to five years in advance. There is also a monthly pay-as-you-go type of deal, but we're doing a yearly renewal and fixing the budget."

"It's a little bit pricey compared to competitors, but it's not too high."

More Microsoft Purview Data Loss Prevention pricing and cost advice

"I don't know yet because they gave us a 30-day test window for free."

"It varies on a case-by-case basis. It is about $2,000 per month. The cost is very low in comparison to other SIEMs if you are already a Microsoft customer. If you are using the complete Microsoft stack, the cost reduces by almost 42% to 50%. Its cost depends on the number of logs and the type of subscription you have. You need to have an Azure subscription, and there are charges for log ingestion, and there are charges for the connectors."

"The are two native advantages for customers that use M365 Security and Sentinel. The first advantage is that the log or security-event ingestion into Sentinel is free. Cost-wise, they're saving a lot and that is a major advantage."

"Sentinel can be expensive. When you ingest data from sources that are outside of the cloud, you're paying a fair amount for that data ingestion. When you're ingesting data sources from within the cloud, depending on what your retention periods are, it's not that expensive."

"The pricing is fair... With a traditional SIEM, you pay a lump sum for licenses. But with Sentinel, it's pay-as-you-go according to the amount of data you inject."

"It is certainly the most expensive solution. The cost is very high. We need to do an assessment using the one-month trial so that we can study the cost side. Before implementing it, we must do a careful calculation."

"It's costly to maintain and renew."

"Cost-wise, Sentinel is based on the volume of information being ingested, so it can be quite pricey. The ability to use strategies to control what data is being ingested is important."

More Microsoft Sentinel pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Microsoft Security Suite solutions are best for your needs.

See recommendations

832,723 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

12%

Manufacturing Company

Retailer

Computer Software Company

16%

Financial Services Firm

11%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Microsoft Purview Data Loss Prevention?

The most valuable features are identifying sensitive data and issuing alerts.

What is your experience regarding pricing and costs for Microsoft Purview Data Loss Prevention?

It is quite expensive for us as the shift to E5 licenses represents a significant increase in cost. The cost works out to about $15 per user per month.

What needs improvement with Microsoft Purview Data Loss Prevention?

There isn't anything specific off the top of my head for improvements. However, more training for end users on how it works would be beneficial.

Is there a common threat intelligence tool that aggregates multiple threat intelligence sources?

Yes, Azure Sentinel is a SIEM on the Cloud. Multiple data sources can be uploaded and analyzed with Azure Sentinel and its Threat Hunting functionality with AI available as templates or customized ...

What is a better choice, Splunk or Azure Sentinel?

It would really depend on (1) which logs you need to ingest and (2) what are your use cases Splunk is easy for ingestion of anything, but the charge per GB/Day Indexed and it gets expensive as log ...

Which is better - Azure Sentinel or AWS Security Hub?

We like that Azure Sentinel does not require as much maintenance as legacy SIEMs that are on-premises. Azure Sentinel is auto-scaling - you will not have to worry about performance impact, you will...

Forcepoint Data Loss Prevention vs Microsoft Purview Data Loss Prevention

Comparisons

Compared 14% of the time

Symantec Data Loss Prevention vs Microsoft Purview Data Loss Prevention

Compared 14% of the time

Zscaler Zero Trust Exchange Platform vs Microsoft Purview Data Loss Prevention

Compared 13% of the time

Amazon Macie vs Microsoft Purview Data Loss Prevention

Compared 11% of the time

Trellix DLP vs Microsoft Purview Data Loss Prevention

Compared 6% of the time

More Microsoft Purview Data Loss Prevention Competitors

AWS Security Hub vs Microsoft Sentinel

Compared 22% of the time

IBM Security QRadar vs Microsoft Sentinel

Compared 10% of the time

Cortex XSIAM vs Microsoft Sentinel

Compared 8% of the time

Wazuh vs Microsoft Sentinel

Compared 6% of the time

Google Chronicle Suite vs Microsoft Sentinel

Compared 5% of the time

More Microsoft Sentinel Competitors

Product Reports

Microsoft Purview Data Loss Prevention

Download Microsoft Purview Data Loss Prevention product report

Microsoft Purview Data Loss Prevention report

Microsoft Sentinel

Download Microsoft Sentinel product report

Also Known As

Microsoft Endpoint Data Loss Prevention, MS Endpoint DLP, Microsoft Endpoint DLP

Azure Sentinel

Overview

At Microsoft, our mission is to empower every person and every organization on the planet to achieve more. Our mission is grounded in both the world in which we live and the future we strive to create. Today, we live in a mobile-first, cloud-first world, and the transformation we are driving across our businesses is designed to enable Microsoft and our customers to thrive in this world.

Microsoft

Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM) and security orchestration automated response (SOAR) solution that lets you see and stop threats before they cause harm. Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Eliminate security infrastructure setup and maintenance, and elastically scale to meet your security needs—while reducing IT costs. With Microsoft Sentinel, you can:

- Collect data at cloud scale—across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds

- Detect previously uncovered threats and minimize false positives using analytics and unparalleled threat intelligence from Microsoft

- Investigate threats with AI and hunt suspicious activities at scale, tapping into decades of cybersecurity work at Microsoft

- Respond to incidents rapidly with built-in orchestration and automation of common tasks

To learn more about our solution, ask questions, and share feedback, join our Microsoft Security, Compliance and Identity Community.

Microsoft

Sample Customers

Information Not Available

Microsoft Sentinel is trusted by companies of all sizes including ABM, ASOS, Uniper, First West Credit Union, Avanade, and more.

Microsoft Purview Data Loss Prevention vs. Microsoft Sentinel