We read the Defender alerts in your Microsoft 365 and take over when something comes up.

Because few SMEs need one. A 24/7 SOC is built for operations where every minute of downtime causes direct damage: hospitals or shift-based manufacturing. An office-based SME ends up paying for a human night shift it rarely needs. Our model therefore separates two layers. Automated detection and defense in Microsoft Defender XDR and Sentinel run around the clock, for example automatically interrupting a risky sign-in. Our analysts assess the situation during business hours (Mon–Fri 08:00–17:30) with contractual response times and take over remediation. If your operation needs human response around the clock, we tell you so openly in the first call. In that case this SOC is not the right service for you.

The one-time onboarding fee starts at CHF 8,230 and is waived if you sign a 4-year minimum contract term. The full onboarding process takes 2 to 3 months across four phases. During technical onboarding (2 weeks) we run the M365 Tenant Review, determine your risk level, and set up the cross-tenant synchronization between your Microsoft Defender XDR and our Security Operations Center. In the Crawl Phase (1 month) we test incident monitoring in live operations and start the collaboration workflow with your internal IT team. In the Walk Phase (a further month) we fine-tune the Defender detection rules to your specific Microsoft 365 environment. From month three onwards, the Security Operations Center runs in full operations (Run Phase) with monthly Service Delivery Reports and quarterly service meetings.

Microsoft Defender XDR detects and blocks at night and on weekends too. Automated defenses such as interrupting a risky sign-in or isolating a suspicious device run in your tenant regardless of business hours. Our analysts take over the next working day from 08:00 with full context, review the automation's decisions, investigate the incident, and start remediation. During business hours the contractual response times apply: 30 minutes for critical incidents, 2 hours for high, 4 hours for medium severity. If you spot something at night yourself, we set up an escalation chain with your internal emergency contact so the morning handover runs smoothly.

Via an M365 Tenant Review (CHF 990 one-time). We analyze your Microsoft 365 tenant's configuration across all relevant security domains: identities in Microsoft Entra ID (MFA, Conditional Access, privileged accounts), endpoint protection (Defender for Endpoint, Intune Device Management), email security (Defender for Office 365, DLP), data classification (Microsoft Purview), and cloud app activity (Defender for Cloud Apps). Based on that analysis we classify your tenant into one of three risk levels: Low (CHF 1,850/month), Moderate (CHF 2,450/month), or High (CHF 3,650/month). A lower level means a lower monthly price and is often achievable through configuration improvements alone, without buying additional licenses. The review is a snapshot of your current configuration, not a verdict on your IT team's work. The review report stays useful even if you decide against the SOC engagement.

Microsoft 365 Business Standard minimum. Low and Moderate risk levels work with Business Standard plus the native Defender features (Defender for Office 365, Microsoft Entra ID with MFA and Conditional Access, Microsoft Purview baseline policies). The High risk level requires Microsoft 365 Business Premium or an equivalent E5 license, because Intune Device Management and Defender for Endpoint (the EDR agent on devices) are deployed there and are not included in Business Standard. If you currently run Microsoft 365 Apps for Business or Microsoft 365 Business Basic, the license upgrade is planned for the Run Phase, jointly with your Microsoft reseller. The tenant review also assesses license fit and tells you the minimum needed.

No, not your business data. The connection runs through a cross-tenant synchronization between your Microsoft Defender XDR and our Security Operations Center. What we see: security signals, incident metadata, anomaly detections, and telemetry from Defender for Endpoint, Defender for Office 365, Microsoft Entra ID, and Defender for Cloud Apps. What we don't see: the contents of your files in OneDrive or SharePoint, the body of your emails, or your Teams chat history. When an incident requires examining mail content (phishing forensics, for example), it always happens inside your tenant and with your explicit approval. The contract is governed by Swiss law, and all data stays in your Microsoft 365 tenant. We don't extract anything into our own infrastructure.

The standard minimum term is 12 months, starting from the beginning of the Run Phase. The contract then auto-renews in 12-month periods, with 3 months' notice required for termination at the end of a period. For contracts of 4 years or longer, the one-time onboarding fee of CHF 8,230 is waived. The 4-year option pays off because the onboarding (tenant review, configuration hardening, cross-tenant setup) is a substantial up-front investment. If your security needs grow during the contract (through company growth or new regulatory requirements), the risk level can be adjusted at any time without a new contract.

The Security Operations Center runs on Microsoft Cloud, not on ODCUS-owned infrastructure. Microsoft Defender XDR and Microsoft Sentinel monitor your tenant continuously, without any action from ODCUS. What we deliver is the continuous interpretation and response to those signals. If an individual ODCUS team member is unavailable, an agreed deputy takes over with a documented onboarding handover. In the rare event that ODCUS as a company became unavailable (extended business interruption), your Microsoft 365 tenant remains entirely in your ownership and under your control. You can sever the cross-tenant connection yourself at any time, and all SOC configurations (analytics rules, playbooks, detection logic) are documented at the tenant review and handed over so another provider could pick them up.