We performed a comparison between Microsoft Purview Data Loss Prevention and Microsoft Sentinel based on real PeerSpot user reviews.
Find out in this report how the two Microsoft Security Suite solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The most valuable features are identifying sensitive data and issuing alerts."
"One of the valuable features of Purview is the ability to create a legal hold on a user's account within the compliance portal. That's pretty useful when it comes to any litigation or if you want to redeem the content within a mailbox, OneDrive, or a generic public SharePoint site."
"Microsoft Purview Data Loss Prevention's responses are faster. Its installation is also reliable. The security score helps with the security part."
"The auto-labeling feature is definitely the most valuable feature. It goes in and labels the documents for you in different repositories. It covers the Outlook and Exchange repositories along with SharePoint and OneDrive. It is really helpful in those areas."
"The product is easy to configure."
"For Purview's natively integrated compliance across Azure, Dynamics 365, and Office 365, I would give it a 10 out of 10. It provides all the insights and information."
"We can use Microsoft Purview Data Loss Prevention to manage devices and site policies."
"I rate Microsoft Purview Data Loss Prevention's stability a ten out of ten."
"We’ve got process improvement that's happened across multiple different fronts within the organization, within our IT organization based on this tool being in place."
"The automation rules and playbooks are the most useful that I've seen. A number of other places segregate the automation and playbook as separate tools, whereas Microsoft is a SIEM and SOAR tool in one."
"Microsoft Sentinel enables you to ingest data from the entire ecosystem and that connection of data helps you to monitor critical resources and to know what's happening in the environment."
"Sentinel enables us to ingest data from our entire ecosystem. In addition to integrating our Cisco ASA Firewall logs, we get our Palo Alto proxy logs and some on-premises data coming from our hardware devices... That is very important and is one way Sentinel is playing a wider role in our environment."
"Microsoft Sentinel provides the capability to integrate different log sources. On top of having several data connectors in place, you can also do integration with a threat intelligence platform to enhance and enrich the data that's available. You can collect as many logs and build all the use cases."
"If you know how to do KQL (kusto query language) queries, which are how you query the log data inside Sentinel, the information is pretty rich. You can get down to a good level of detail regarding event information or notifications."
"Sentinel uses Azure Logic Apps for automation, which is really powerful. This allows us to easily automate responses to incidents."
"Free ingestion for Azure logs (with E5 licence)"
"The solution should provide better integration with other systems."
"There is a need for improvements, particularly in ensuring that file-based recognition is more reliable and comprehensive."
"The platform can be challenging to navigate and has the potential for improvement."
"The scalability, in terms of the portal, could be more user-friendly. Sometimes I have faced difficulties in identifying the options."
"Technical support is awful."
"Microsoft Purview Data Loss Prevention's licensing is expensive."
"I would like Microsoft Purview Data Loss Prevention to be on the source code or SQL databases. It is difficult to do classification and labeling when you have a third-party source code or a third-party Oracle database. It is seamless when it comes to Microsoft documents but is not so with third-party source codes. Microsoft needs to work on it a little bit more."
"They do not provide language options beyond the ones already available, so our language option is missing."
"It could have a better API to be able to automate many things more extensively and get more extensive data and more expensive deployment possibilities. It can gain some points on the automation part and the integration part. The API is very limited, and I would like to see it extended a bit more."
"Not all information shows up in Sentinel. Sometimes there are items provided in 365 and if you looked in Sentinel you would not see them and therefore think they do not exist. There can be discrepancies between Microsoft tools."
"If I see an alert and I want to drill down and get more details about the alert, it's not just one click. In other SIEM tools, you just have to click the IP address of the entity and they give you the complete picture. In Sentinel, you have to write queries or use saved queries to get details."
"There are certain delays. For example, if an alert has been rated on Microsoft Defender for Endpoint, it might take up to an hour for that alert to reach Sentinel. This should ideally take no more than one or two seconds."
"Sometimes, it is hard for us to estimate the costs of Microsoft Sentinel."
"Given that I am in the small business space, I wish they would make it easier to operate Sentinel without being a Sentinel expert. Examples of things that could be easier are creating alerts and automations from scratch and designing workbooks."
"We've seen delays in getting the logs from third-party solutions and sometimes Microsoft products as well. It would be helpful if Microsoft created a list of the delays. That would make things more transparent for customers."
"We have been working with multiple customers, and every time we onboard a customer, we are missing an essential feature that surprisingly doesn't exist in Sentinel. We searched the forums and knowledge bases but couldn't find a solution. When you onboard new customers, you need to enable the data connectors. That part is easy, but you must create rules from scratch for every associated connector. You click "next," "next," "next," and it requires five clicks for each analytical rule. Imagine we have a customer with 150 rules."
More Microsoft Purview Data Loss Prevention Pricing and Cost Advice →
Microsoft Purview Data Loss Prevention is ranked 12th in Microsoft Security Suite with 13 reviews while Microsoft Sentinel is ranked 5th in Microsoft Security Suite with 86 reviews. Microsoft Purview Data Loss Prevention is rated 8.0, while Microsoft Sentinel is rated 8.2. The top reviewer of Microsoft Purview Data Loss Prevention writes "Automation has given us consistent analytics and improved quality of insights into user activity". On the other hand, the top reviewer of Microsoft Sentinel writes "Gives a comprehensive and holistic view of the ecosystem and improves visibility and the ability to respond". Microsoft Purview Data Loss Prevention is most compared with Symantec Data Loss Prevention, Forcepoint Data Loss Prevention, Amazon Macie, Microsoft Intune and Zscaler DLP, whereas Microsoft Sentinel is most compared with AWS Security Hub, IBM Security QRadar, Wazuh, Microsoft Defender for Cloud and Elastic Security. See our Microsoft Purview Data Loss Prevention vs. Microsoft Sentinel report.
See our list of best Microsoft Security Suite vendors.
We monitor all Microsoft Security Suite reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
