Microsoft Sentinel Analytics redirects to SIEM Workspaces in Defender portal

Question

Microsoft Sentinel Analytics redirects to SIEM Workspaces in Defender portal

Anupriya Sehgal 0

Travaughn Watson 0 Reputation points

2026-09-29T01:36:52.66+00:00

So I thought I was the only one having this issue, I haven't been able to find a solution that works. I have checked all my permissions and roles, etc. But nothing will make the Analytics page show in the Defender portal.

3 answers

Your answer

Travaughn Watson 0 Reputation points

2026-09-29T01:36:52.66+00:00

So I thought I was the only one having this issue, I haven't been able to find a solution that works. I have checked all my permissions and roles, etc. But nothing will make the Analytics page show in the Defender portal.

Answer 1

Anton W 1

Hi @Anupriya Sehgal , @Travaughn Watson ,

Are you trying to access "analytics" in Sentinel in the Azure Portal or Sentinel within Defender XDR portal? When did you create this Sentinel Workspace?

I found it takes a little bit of time after creating a new workspace and having it automatically connected to Defender for the menu options to display properly but when you click on Analytics in Defender under Sentinel, your should see your templates and what not:

User's image

Travaughn Watson 0 Reputation points

2026-10-06T02:42:28+00:00

Yes, this is a fairly new workspace I created for a lab I’m working on. I was trying to access it in the Defender XDR Portal, I eventually gave up on t trying to do it that way and found that if you press Ctrl + Shift + R when getting the screen that says “Go to the new Defender Portal” it will clear the session cookies for the website, reload the page, and I was able to access Analytics on the Azure Portal instead. But good to know, thank you!

Answer 2

Anupriya Sehgal 0

I checked if you use organisation email then only we can use Microsoft defender not with personal email.

0 comments

Answer 3

This redirect is expected as Microsoft Sentinel is moving to the Microsoft Defender portal experience.

Key points:

Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers without Microsoft Defender XDR or an E5 license.
After March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Defender portal.
For some customers and workspaces, Sentinel experiences in Azure already redirect to the Defender portal.
In the Defender portal, Sentinel workspaces are managed under System > Settings > Microsoft Sentinel > Connect a workspace.

If Analytics is redirecting to SIEM workspaces in the Defender portal, that indicates the workspace is using the Defender portal experience. To work with Sentinel there:

Open the Microsoft Defender portal.
Go to System > Settings > Microsoft Sentinel.
Verify the workspace is connected.
If needed, use Connect a workspace and select the workspace.
Select a Primary workspace if prompted.

For existing Azure portal users, the recommended action is to plan and complete the transition to the Defender portal.