Local Authority Security with Microsoft Defender and Sentinel

Overview

Connecting prevention, detection and response

Konsolute brought Microsoft Defender for Endpoint and Microsoft Sentinel together around the way the council's staff actually work.

We deployed Defender for Endpoint across 5,000 council devices, connected Sentinel to the council's key Microsoft security data, and built a response process that contains threats quickly while keeping services running. Every configuration decision was checked against relevant NCSC guidance and the applicable CIS Benchmarks, and the evidence was handed to the council's team so they could run and maintain the service themselves.

The challenge

Protecting council services across a distributed workforce

The council's staff work from offices, community sites and home. Their devices, identities and cloud applications all needed protecting together, so that people could reach the services they rely on while the security team could spot and act on suspicious activity.

Protection and monitoring had grown up piece by piece. The council needed a clear picture of what was covered, where the configuration gaps were, and who would investigate and respond when something went wrong. Any response also had to account for the cost of locking a frontline worker out of their account or device in the middle of delivering a service.

Our approach

Build the controls, then prove they work

We started by assessing the council's existing Microsoft environment, its endpoints and its security operations arrangements. Together with the council, we agreed the workloads and data sources in scope, who owned what, and the acceptance criteria for each control before anything was deployed. A pilot with the council's IT team showed how the controls behaved and how they affected normal working.

That gave us a way to tell the difference between a product that is installed and a control that is working as intended. Every configuration decision, exception and test result was documented, so the council understood exactly what it had and could maintain it after handover.

Microsoft Defender for Endpoint: protection and investigation. We onboarded 5,000 devices to Microsoft Defender for Endpoint and checked onboarding status, sensor health and policy application on each. Configuration covered antivirus protection, tamper protection, attack surface reduction rules and firewall settings.

Restrictive settings were introduced in audit mode first, with pilot groups surfacing application compatibility issues before wider rollout. Every exception was given a named owner and a recorded reason, so none became an undocumented gap in protection.

The council's security team now uses Defender's device, user and process context to decide how to contain and remediate an alert, rather than working from the alert alone.

Microsoft Sentinel: one place to monitor security. We deployed Microsoft Sentinel in the council's Azure environment, with access and operational responsibilities agreed up front. We connected Microsoft Defender XDR incidents, Microsoft Entra ID sign-in and audit logs, Office 365 activity and Azure Activity logs.

Data ingestion was validated before any detection was relied on. Analytics rules were selected and tuned to the threats that matter to the council and the telemetry available, and incident grouping cut down on duplicated investigation. Data collection and retention were set to balance review requirements against running costs.

Monitoring covers the health of each data source as well as the incidents it raises, so a disconnected source is never mistaken for a quiet day.

Automated response

Consistent action with proportionate safeguards

We built Sentinel automation rules and Azure Logic Apps playbooks for the council's repeatable response tasks: enriching incidents with device and user context, notifying the security team in Microsoft Teams, and creating tickets in the council's service desk.

Higher-impact actions, such as isolating a device, disabling an account or revoking sessions, run only under agreed conditions and with approval from the on-call security lead. Those rules weigh the effect on public services alongside the urgency of containment. Each playbook has only the permissions it needs, and escalates to a person if it fails or cannot finish.

Every workflow was tested for expected behaviour, error handling and audit logging. The council has a clear record of which steps are automated, which need an analyst's decision, and how responsibility passes between teams.

Technical assurance

Evidence-based alignment with NCSC guidance and CIS Benchmarks

We mapped the council's agreed requirements to relevant NCSC guidance and the applicable CIS Benchmarks for each technology in scope. Benchmark versions, the recommendations applied and any accepted exceptions were recorded alongside evidence of the controls in place and the checks completed.

Configuration reviews, controlled detection tests and playbook validation provided that evidence. At handover, the council received a record of remaining gaps, outstanding actions, review responsibilities and the documentation needed to maintain the environment.

Deploying Defender or Sentinel does not on its own make an organisation compliant. What the council has instead is a clear, evidenced account of which recommendations were addressed, how each was verified, and where further work remains.

Result

Security the council can see, run and evidence

The council now has endpoint protection across 5,000 devices, its key security signals in one place, and a tested response process that its own team owns. Security staff investigate from a single view instead of switching between consoles, and higher-impact actions follow agreed rules that protect frontline services.

Routine enrichment, notification and ticketing now happen automatically, so analysts spend their time on investigation and decisions rather than gathering information or logging incidents by hand.

The council also has documented evidence of how its configuration aligns with NCSC guidance and CIS Benchmarks, ready for internal audit and external assessment.