We want to set up Microsoft Sentinel at small scale, how?

Sentinel is not an MSP-only product. For SMBs on Microsoft 365 it is a log tank with a few free sources, plus the option to add expensive ones. Start narrow, otherwise the bill blindsides you.

Try this first

1. 1Create a Log Analytics workspace in Azure in the same region as your tenant. Enable Sentinel on it. Expect 5 to 10 euros of startup cost in month one before data flows in.
2. 2Connect the free sources: Entra sign-in and audit logs, Office 365 (Exchange, SharePoint, Teams audit), Microsoft Defender XDR. These ingest free if you hold M365 E5 or equivalent licenses.
3. 3Do not turn everything on. Defender for Endpoint advanced hunting can push thousands of events per minute. Start with alerts only, not raw events, or the Log Analytics bill takes off.
4. 4Enable a handful of built-in analytics rules: Sign-in from anonymous IP, Mass download by user, Brute force activity. Microsoft ships templates, you do not write from zero.
5. 5Set a budget alert on the workspace itself in Azure Cost Management. 50 euros per person per month is realistic without heavy raw logs. Above that, check what you accidentally enabled.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.