01 The Security Incentive Landscape — 10 Programs, 4 Categories
Microsoft structures security incentives into four categories, each targeting a different phase of the customer engagement lifecycle. Understanding which category each program falls into is the key to stacking them effectively.
Security is where the money is in FY26. Microsoft is investing more in security partner incentives than any other solution area — because they need partners to drive Defender and Sentinel adoption at scale. Partners who build a security practice are tapping into the deepest incentive pool in the program.
02 The Four Envisioning Workshops — $5.5K to $8K Each
Each workshop is a structured, multi-day engagement delivered in the customer's production environment. You discover real threats and vulnerabilities using Microsoft security products, build purchase intent, and submit proof of execution through a simplified FY26 survey process.
| Workshop | Focus Area | Market A | Market B | Market C | Performance Requirement |
|---|---|---|---|---|---|
| Threat Protection Envisioning | Defender XDR, identity protection | $8,000 | $6,500 | $5,500 | Drive Defender revenue growth |
| Modern SecOps Envisioning | Sentinel, unified SecOps platform | $8,000 | $6,500 | $5,500 | $20K Security ACR growth |
| Data Security Envisioning | Microsoft Purview, DLP, compliance | $8,000 | $6,500 | $5,500 | $20K billed revenue growth |
| Cloud Security Envisioning | Defender for Cloud, CSPM | $8,000 | $6,500 | $5,500 | $12.5K Security ACR growth |
Each workshop has mandatory modules plus selectable modules that the partner chooses based on the customer's environment. The Threat Protection workshop, for example, requires Defender XDR and Cloud Identity Protection as mandatory, then the partner selects 3 of 6 additional modules (Sentinel, Email, Endpoint, Server, Identity, or Copilot demo).
FY26 simplification: Microsoft moved to survey-based proof of execution this year — customer survey, partner survey, and invoice. No more complex documentation packages. This makes workshops faster to claim.
PIE's Incentive Claims module tracks every workshop engagement from delivery through payout. Upload your SOW and PIE identifies which workshops the project qualifies for, then monitors the claim lifecycle — submission, validation, and payment. No more tracking workshops in spreadsheets.
03 The Sentinel Accelerator — Up to $38K Per Customer
The Sentinel Accelerator is the highest-value individual security incentive in the program. It uses a unique dual payment model that rewards both initial activation and sustained usage growth.
🔐 Sentinel Accelerator Dual Payment Model
Eligibility requirements: The customer must be an existing Sentinel account currently ingesting less than 50 GB/day (trailing 3-month average). The partner must hold Solutions Partner for Security and the active Threat Protection Advanced Specialization. This is not a beginner program — it is designed for partners who are already deeply embedded in Sentinel delivery.
Smart partners deliver a Modern SecOps Envisioning Workshop ($8K) to build customer intent, then follow up with the Sentinel Accelerator ($4K–$38K) for the same customer's deployment. That is $12K–$46K from a single customer relationship across two programs with separate eligibility criteria. The workshop is pre-sales, the accelerator is post-sales — perfectly designed to stack.
04 MDC Accelerator and CSP Deployment Programs
Defender for Cloud (MDC) Accelerator
The MDC Accelerator rewards partners for driving increased usage of Microsoft Defender for Cloud among existing customers. Unlike the fixed-fee workshops, MDC payouts are consumption-based and tiered by growth in Defender for Cloud spending. The program falls under the Security Accelerators earning cap.
CSP Defender & Purview Deployment
Two CSP deployment programs reward partners for adding Defender and Purview suite seats through Cloud Solution Provider licensing:
| Program | Seat Requirement | Market A | Market B | Market C | Exclusions |
|---|---|---|---|---|---|
| Standard (S) | 300+ seats | $1,750 | $1,500 | $1,250 | Nonprofit, EDU, and Government NOT eligible |
| Standard (M) | 300+ seats | $3,000 | $2,750 | $2,500 | |
| Standard (L) | 300+ seats | $6,500 | $6,000 | $5,500 | |
| Standard (XL) | 300+ seats | $10,000 | $8,000 | $7,000 | |
| Business Premium | 100–300 seats | $1,750 | $1,500 | $1,250 |
05 Immersion Briefings — Pipeline Generation at $1.5K–$2K
Immersion Briefings are the lightest-touch programs in the security incentive portfolio. They are designed as demand generation tools — shorter sessions that introduce customers to Microsoft security products and build pipeline for larger engagements.
| Briefing | Focus | Market A | Market B | Market C |
|---|---|---|---|---|
| Threat Protection Immersion | Defender XDR, endpoint, identity | $2,000 | $1,500 | $1,500 |
| Data Security Immersion | Purview, DLP, information protection | $2,000 | $1,500 | $1,500 |
While the payouts are lower than workshops, Immersion Briefings serve a strategic purpose: they create the pipeline for workshops and accelerators. A Threat Protection Immersion can lead to a Threat Protection Envisioning Workshop, which can lead to a Sentinel Accelerator. The briefing is the top of the security incentive funnel.
06 Earning Caps — Two Pools, $1.75M Combined
Microsoft separates security incentive earnings into two independent cap categories. These caps are additive — a partner earning from both categories has access to up to $1.75M globally.
Most security partners never come close to hitting these caps. A partner delivering 10 workshops per year earns $55K–$80K — well under the $1M activities cap. The caps exist to prevent a handful of large partners from consuming the entire program budget, but for the vast majority of partners, they are effectively uncapped.
07 The Security Stacking Strategy — One Customer, Four Programs
The highest-value play in security incentives is stacking multiple programs for the same customer across the engagement lifecycle. Here is the optimal sequence:
Total from one customer: $15,750 to $58,000. Four separate programs, four separate claims, all from a single customer relationship. This is why Microsoft designed them as distinct programs with distinct eligibility — they are meant to be stacked.
Upload a security SOW and PIE identifies not just the primary incentive program — it maps all qualifying programs that could stack for the same customer. PIE's SOW Analyzer checks workshop eligibility, Sentinel Accelerator qualification, and CSP deployment potential simultaneously. One upload, full stacking visibility.
08 Security Incentive Calculator
Estimate your annual security incentive revenue based on the number of engagements you plan to deliver. All amounts use Market A pricing.
🔐 Security Incentive Estimator
09 Prerequisites: What You Need Before You Earn
Every security incentive program has prerequisites. Here is the complete map — the certification pipeline that feeds security incentive eligibility.
| Program | Partnership Required | Designation Required | Specialization Required | Key Certifications |
|---|---|---|---|---|
| Envisioning Workshops (all 4) | MAICPP | SP: Security | Not required | SC-200, SC-300, SC-100 |
| Sentinel Accelerator | MAICPP | SP: Security | Threat Protection | SC-200, SC-100 |
| MDC Accelerator | MAICPP | SP: Security | Varies | AZ-500, SC-200 |
| CSP Deployment (Standard) | CSP Direct Bill | Not required | Not required | N/A |
| CSP Deployment (BP) | CSP Direct Bill | Not required | Not required | N/A |
| Immersion Briefings (both) | MAICPP | SP: Security | Not required | SC-200, SC-300 |
The pattern is clear: Solutions Partner for Security is the gate for 8 of 10 programs. Only the CSP deployment programs skip the designation requirement. And the highest-value program — the Sentinel Accelerator — requires the Threat Protection Advanced Specialization on top of the designation.
10 The 33% Performance Rule
Microsoft applies a 33% portfolio performance rate across all activity-based security investments. Over time, at least one-third of the customers you deliver security workshops or accelerators for must show measurable growth in Defender revenue or Security ACR.
This is not a per-engagement requirement — it is a portfolio-level metric applied across all your security deliveries. If your overall portfolio performance falls below 33%, Microsoft can restrict future engagement nominations. The message is clear: Microsoft wants partners driving genuine adoption, not just collecting workshop fees.
For most delivery-focused partners, this threshold is easy to meet. If you are delivering quality Sentinel deployments and Defender workshops, customer usage grows naturally. The 33% rule mainly catches partners who deliver minimal-effort workshops with no follow-through.
Map Your Security Incentive Potential in 60 Seconds
Upload a security SOW and PIE identifies every qualifying incentive program — workshops, accelerators, and stacking opportunities — automatically.
Book a Demo →FAQ Frequently Asked Questions
How much can Microsoft partners earn from security incentive programs in FY26?
+Microsoft offers 10 security incentive programs with earning caps of $1M globally for activities and $750K for accelerators. Individual engagements pay $1,500 to $38,000. A partner delivering workshops and accelerators across multiple customers could realistically earn $40K–$150K+ per year in security incentive revenue.
What is the Sentinel Accelerator dual payment model?
+The Sentinel Accelerator pays twice: a $4,000 activation payment when the customer reaches 50GB/day ingestion within 90 days, plus a stabilization payment — $4K (50-99.9 GB), $11K (100-199.9 GB), or $34K (200+ GB) based on highest consecutive 90-day average. Maximum per customer is $38,000. Both payments must occur within 180 days.
What prerequisites do I need for security incentive programs?
+Workshop and briefing programs require Solutions Partner for Security. The Sentinel Accelerator also requires Threat Protection Advanced Specialization. CSP deployment programs require CSP partnership but no designation. All programs require Microsoft Commerce Incentives enrollment and a 33% portfolio performance rate.
What are the four Security Envisioning Workshops?
+Threat Protection Envisioning (Defender XDR focus), Modern SecOps Envisioning (Sentinel and unified SecOps), Data Security Envisioning (Microsoft Purview), and Cloud Security Envisioning (Defender for Cloud). Each pays $8K/$6.5K/$5.5K by market tier. All require multi-day delivery with mandatory modules.
What is the MDC Accelerator?
+The MDC (Microsoft Defender for Cloud) Accelerator rewards partners for driving increased Defender for Cloud usage. Payouts are consumption-based and tiered by growth. It falls under the Security Accelerators earning cap of $750K globally.
Can I stack multiple security incentive programs for the same customer?
+Yes. The optimal stack is: Immersion Briefing ($2K) → Envisioning Workshop ($8K) → Sentinel Accelerator ($4K–$38K) → CSP Deployment ($1.75K–$10K). That is $15K–$58K from one customer across four separate programs. Each program has its own eligibility — the customer must qualify for each independently.
What are Security Immersion Briefings?
+Shorter demand-generation sessions that introduce security products to customers. Threat Protection Immersion and Data Security Immersion pay $2K/$1.5K/$1.5K by market. Lower delivery effort than full workshops, designed as pipeline generators for larger engagements.
What is the 33% performance measurement?
+Microsoft requires a 33% portfolio performance rate across all security activities — at least one-third of customers you deliver for must show measurable growth in Defender revenue or Security ACR. This is portfolio-level, not per-engagement. If your rate falls below 33%, Microsoft can restrict future nominations.
What is the difference between Security Activities and Security Accelerators caps?
+Security Activities (workshops + briefings) cap at $1M global / $500K regional. Security Accelerators (Sentinel, MDC, CSP deployment) cap at $750K global / $500K regional. These are additive — a partner maxing both categories could earn $1.75M globally from security programs alone.
How do CSP Defender and Purview deployment incentives work?
+Standard deployments require 300+ net new Defender or Purview seats via CSP and pay $1,750–$10,000 by size (S/M/L/XL) and market. Business Premium add-on deployments require 100–300 seats and pay $1,250–$1,750. Nonprofit, education, and government customers are not eligible.