Microsoft Sentinel

Access to this page requires authorization. You can try signing in or changing directories .

Access to this page requires authorization. You can try changing directories .

Microsoft Sentinel is a cloud-native SIEM solution that delivers scalable, cost-efficient security across multicloud and multiplatform environments. It combines AI, automation, and threat intelligence to support threat detection, investigation, response, and proactive hunting.

Microsoft Sentinel SIEM empowers analysts to anticipate and stop attacks across clouds and platforms, faster and with greater precision.

This article highlights the key capabilities in Microsoft Sentinel.

Microsoft Sentinel inherits the Azure Monitor tamper-proofing and immutability practices. While Azure Monitor is an append-only data platform, it includes provisions to delete data for compliance purposes.

This service supports Azure Lighthouse , which lets service providers sign in to their own tenant to manage subscriptions and resource groups that customers have delegated.

Enable out of the box security content

Microsoft Sentinel provides security content packaged in SIEM solutions that enable you to ingest data, monitor, alert, hunt, investigate, respond, and connect with different products, platforms, and services.

For more information, see Microsoft Sentinel content and solutions .

Collect data at scale

Collect data across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.

This table highlights the key capabilities in Microsoft Sentinel for data collection.

Detect previously undetected threats and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.

This table highlights the key capabilities in Microsoft Sentinel for threat detection.

Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.

This table highlights the key capabilities in Microsoft Sentinel for threat investigation.

Respond to incidents rapidly

Automate your common tasks and simplify security orchestration with playbooks that integrate with Azure services and your existing tools. Microsoft Sentinel's automation and orchestration provides a highly extensible architecture that enables scalable automation as new technologies and threats emerge.

Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps. For example, if you use the ServiceNow ticketing system, use Azure Logic Apps to automate your workflows and open a ticket in ServiceNow each time a particular alert or incident is generated.

This table highlights the key capabilities in Microsoft Sentinel for threat response.

Microsoft Sentinel in the Azure portal retirement timeline

Microsoft Sentinel is generally available in the Microsoft Defender portal , including for customers without Microsoft Defender XDR or an E5 license. This means that you can use Microsoft Sentinel in the Defender portal even if you aren't using other Microsoft Defender services.

After March 31, 2027 , Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal.

If you're currently using Microsoft Sentinel in the Azure portal, we recommend that you start planning your transition to the Defender portal now to ensure a smooth transition and take full advantage of the unified security operations experience offered by Microsoft Defender .

For more information, see:

Microsoft Sentinel in the Microsoft Defender portal

Transition your Microsoft Sentinel environment to the Defender portal

Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers (blog)

Changes for new customers starting July 2025

For the sake of the changes described in this section, new Microsoft Sentinel customers are customers who are onboarding the first workspace in their tenant to Microsoft Sentinel .

Starting July 2025 , such new customers who also have the permissions of a subscription Owner or a User access administrator , and are not Azure Lighthouse-delegated users, have their workspaces automatically onboarded to the Defender portal together with onboarding to Microsoft Sentinel.

Users of such workspaces, who also aren't Azure Lighthouse-delegated users, see links in Microsoft Sentinel in the Azure portal that redirect them to the Defender portal.

Such users use Microsoft Sentinel in the Defender portal only.

New customers who don't have relevant permissions aren't automatically onboarded to the Defender portal, but they do still see redirection links in the Azure portal, together with prompts to have a user with relevant permissions manually onboard the workspace to the Defender portal.

This table summarizes these experiences:

Onboard Microsoft Sentinel

Deployment guide for Microsoft Sentinel

Plan costs and understand Microsoft Sentinel pricing and billing

Was this page helpful?

Need help with this topic?

Want to try using Ask Learn to clarify or guide you through this topic?

Last updated on 2026-05-14