The Microsoft Security Partner Playbook: Turning the SOC Gap into a Services Practice

Your customers' SOC gap is your services opportunity. This is the partner half of the story: what to sell, to whom, and how to deliver it.

Three Solution Plays

Microsoft doesn't sell security as one motion. For FY27 it reorganised its security solution plays around customer outcomes, with trust in AI at the centre:

Source: Microsoft Security Partners site, October 2026. In FY26 the plays were product-shaped: Modern SecOps with Unified Platform, Data Security, and Protect Cloud, AI Platforms and Apps.

The shift matters for how you sell. A SOC consolidation is no longer the headline; it's how you deliver the “trusted platform for AI” that the customer's board is asking about.

Where the Growth Is

Forrester's study commissioned by Microsoft (The Partner Opportunity For Microsoft Security Partners, November 2025) modelled what a partner can expect to earn from a new enterprise customer.

That expected revenue grew 20% year on year. Managed services is the largest stream — $23.35 of $54.35 per user per month — and grew 24%. Advisory grew fastest, at 35%.

Read it as a vendor-commissioned model built from 15 partner interviews, not a forecast for your practice. The pattern holds, though: advisory opens the door and managed services pays the bills. Forrester's interviewees said 40% of projects lead to a managed-services opportunity.

One decision now sits at the centre of every MXDR practice. Microsoft's own Defender Experts MDR Plan 2 extends to non-Microsoft sources through Sentinel (announced July 2026). Decide deliberately where you co-sell it and where your own SOC is the differentiator.

Four Conversation Starters

Four dated changes give you a reason to call a customer this quarter:

The Win Formula, Stage by Stage

1. Listen & consult: build pipelineCampaign-in-a-box, propensity targeting (CloudAscent for SMB, Microsoft 365 Lighthouse opportunities) and 1:many Threat Protection and Data Security Immersion Briefings.
2. Inspire & design: design the solutionA rapid security assessment, then a customer-specific business case. The Security Business Case Builder models vendor-consolidation savings.
3. Empower & achieve: win the dealCheck which CSP incentives apply in the current program guide.
4. Realise value: deploy and drive usageDefender XDR workload usage, and data security that doesn't block end users.
5. Manage & optimise: expandAttach integration, SOC-efficiency, IR-automation and compliance-automation services.

One honesty rule for the business case: the Business Premium suite prices compare against standalone list prices, and Business Premium already includes Defender for Business and Entra ID P1. Show the customer the uplift and the tools they'll actually retire, not the headline delta. The full caveat is in the CFO slide.

Funding and Designation

Immersion briefings are Microsoft's funded top-of-funnel motion for smaller customers: 90-minute, partner-led sessions on Threat Protection, Data Security or Advanced Security for Business Premium.

Partners with co-op funding can reimburse eligible delivery costs and run up to 20 open submissions at a time. Check the current amounts in Partner Center.

The Solutions Partner for Security designation needs 70 of 100 points, with at least one point in each of four metrics: net customer adds, intermediate certifications, deployments and usage growth. Microsoft scores you on an enterprise and an SMB path and keeps the better result (Microsoft Learn).

Skilling is the lever a practice lead controls most directly. Net customer adds, deployments and usage growth are each capped at 20 points, so certifications carry the rest.

The required path: an Azure Security Engineer (retired 31 August 2026) or Cloud and AI Security Engineer certification, plus SC-200 Security Operations Analyst. Points then come from SC-100 Cybersecurity Architect, SC-300 Identity and Access Administrator or SC-401 Information Security Administrator.

From Pitch to Delivery

The customer's plan is the 180-day roadmap: identity and onboarding first, then one portal and automatic attack disruption, then AI protection at scale. Map each phase to an offer, and price the managed service from day 90, when the SOC is unified and there is something to run:

Sell the outcome the CISO asked for — knowing within minutes when someone in finance clicks the wrong link — and the licences follow.

Build your security practice

Designing a Sentinel migration offer, an MXDR service or an agent-governance sprint? I help partners shape the offer, the reference architecture and the business case.