SentinelOne or Microsoft Defender for Business for a 50-person company

Hi everyone! 👋 Our company is finally upgrading from our current, somewhat piecemeal endpoint protection to a proper EDR/XDR solution. We're a 50-person tech shop, mostly developers, with a mix of Windows and macOS machines.

We've narrowed it down to **SentinelOne** and **Microsoft Defender for Business** (part of the Microsoft 365 suite). The pricing for Defender is attractive since we're already on M365, but I'm wary of it being "good enough" rather than "great." I've heard S1's behavioral AI is top-tier, but is it worth the extra cost and complexity for our size?

My main concerns are:
* **Detection & Response**: How do they compare in real-world scenarios for a dev-heavy environment? We run a lot of custom scripts and tools that sometimes look... unusual.
* **Management Overhead**: We don't have a dedicated security team. Which platform is more manageable day-to-day without constant fine-tuning?
* **False Positives**: This is huge. I don't want to be constantly whitelisting our internal dev tools.

I'd love to hear from teams of similar size. Specifically:
* Any gotchas with the Defender for Business setup? Does it play nicely with non-Microsoft cloud services?
* For SentinelOne users, how hands-on is the policy configuration? Can you share snippets of how you've tuned rules for a developer workstation? For example, how do you handle `python` or `node` processes making network calls?

```yaml
# Example of a SentinelOne policy snippet I'm curious about:
processes:
- name: "python.exe"
actions:
- "network"
restrictions:
- "allow_specific_ips"
```

* Any major differences in the investigation experience when you need to dig into an alert?

Thanks in advance for your insights! Concrete examples and config snippets are worth their weight in gold.