Microsoft Sentinel: Incident Link Not Opening Referenced Incident — Troubleshooting Assistance Needed

JonathanSkitt-1100 0 Reputation points
2026-10-01T13:40:30.4166667+00:00

Problem description

I am experiencing an issue where the links in incident notification emails from Microsoft Sentinel and Microsoft 365 Defender do not open the referenced incident as expected. Instead, clicking the link opens the incident list or only displays a limited number of incidents, and the specific incident does not open directly.

Environment

The affected service involves Microsoft Sentinel and Microsoft 365 Defender, specifically within the incident notification and portal-based incident experience.

What I've already tried

I have reviewed the incident notification email and attempted to click the links, but they only open the incident list rather than the specific incident. I also tried accessing the incident directly in the Sentinel portal by searching for the incident ID, but the link from the email does not navigate to it directly. Additionally, I have verified that the incident exists in the portal and is in an open state, with the incident ID matching the alert ID provided in the email.

Current status

I am seeking assistance to understand why the incident links in the notification emails are not opening the referenced incident directly and to find a solution to ensure the links work as intended.

Microsoft Security | Microsoft Sentinel

1 answer

Sort by: Most helpful
  1. Anton W 1 Reputation point
    2026-10-05T23:30:22.3566667+00:00

    Hi @JonathanSkitt-1100 ,

    Kind of sounds like a browser caching issue.

    If you open a private browser session and then copy and paste the incident link into the browser and authenticate (you should be prompted to authenticate because it is a private browser session), and see if the incident loads or if you get the same behaviour.

    Kind regards,
    Anton

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.