Question about Sentinel end of support

Luikart, Christopher 20 Reputation points
2026-10-29T18:16:56.9433333+00:00

I got a notice from Microsoft about the end of support for Sentinel in the Azure portal on March 31, 2027. I only have one Sentinel instance in Azure at the moment and have already connected it to the defender portal per the documentation attached to the notice. Is there anything else I need to do to onboard before March 31st?

Microsoft Security | Microsoft Sentinel
0 comments
Answer accepted by question author

AI answer

2026-10-29T18:18:33.28+00:00

If your single Sentinel workspace is connected and the Defender portal reports that the environment is ready, the onboarding itself is complete; the March 31, 2027 retirement applies to the Azure portal experience, not to the Sentinel service or workspace.

Confirm completion

In the Microsoft Defender portal:

  1. Go to System → Settings → Microsoft Sentinel.
  2. Confirm that your workspace is listed as connected. With only one workspace, it is automatically designated the primary workspace.
  3. Open Home and confirm that the readiness banner appears and Sentinel metrics—such as data connectors and automation rules—are displayed.
  4. Confirm that Microsoft Sentinel appears in the left navigation.

These are Microsoft’s documented completion indicators.^1^

No Defender XDR or Microsoft 365 E5 license is required to use Sentinel in the Defender portal. After March 31, 2027, Azure-portal Sentinel users will be redirected to the Defender portal.^2^

Required checks where applicable

Connecting the workspace is sufficient unless one of these configurations applies.

  • Defender XDR data connector: Onboarding automatically enables this connector, so do not configure it again manually.^3^ In Sentinel’s Data connectors, open the Microsoft Defender XDR connector and verify that incidents and alerts are turned on. Microsoft security-product alerts are routed through this connector after onboarding.^4^
  • Analytics-rule incident settings: If any analytics rules use Sentinel incident-creation or alert-grouping settings, complete Microsoft’s Migrate Microsoft Sentinel incident creation rules and alert grouping settings to Defender XDR procedure before operating exclusively from the Defender portal. This is a configuration migration, separate from connecting the workspace.^4^
  • Microsoft Defender for Cloud: If you want tenant-wide correlated Defender for Cloud incidents in this primary workspace:
    1. Connect Tenant-based Microsoft Defender for Cloud (Preview) in the primary workspace.
    2. Disconnect Subscription-based Microsoft Defender for Cloud (Legacy) alerts connectors from all workspaces in the tenant.
    If tenant-wide correlation is not wanted, retain the legacy subscription-based connector instead.^1^
  • Microsoft Purview Insider Risk Management: If your organization uses it, install the Microsoft Purview Insider Risk Management solution from Content hub, then enable the Microsoft 365 Insider Risk Management connector on the primary workspace. The instruction to disable it on secondary workspaces does not apply while you have only one workspace.^1^

These checks are advisable but do not represent additional onboarding:

  • Open recent incidents and confirm analysts can investigate and update them.
  • Run a known KQL query under Investigation & response → Hunting → Advanced hunting.
  • Review data connectors, analytics rules, automation rules, playbooks, workbooks, and integrations used by your SOC.
  • Confirm your automation and ticketing workflows still process a test incident.
  • Review the Defender portal’s feature-location and limitation tables, because some Sentinel functions moved and certain Defender-dependent capabilities are limited when Sentinel is used without other Defender services.^2^
  • Review the Defender XDR data-storage and privacy policies, which apply when Sentinel is used through the Defender portal.^4^

Permissions

  • View/query and validation: typically requires Microsoft Sentinel Reader.
  • Change incidents or Sentinel configuration: requires Microsoft Sentinel Contributor or equivalent permissions.
  • Onboarding: requires at least Security Administrator in Microsoft Entra ID plus an unconditional subscription-scope Owner, or User Access Administrator plus Microsoft Sentinel Contributor. These elevated onboarding permissions are not needed merely to confirm an already-connected workspace.^1^

Continue managing Sentinel users’ Azure RBAC assignments in Azure; those permission changes are reflected in the Defender portal.^1^

References

  1. Connect Microsoft Sentinel to the Microsoft Defender portal
  2. Microsoft Sentinel in the Microsoft Defender portal
  3. Stream data from Microsoft Defender XDR to Microsoft Sentinel in the Azure portal
  4. Transition your Microsoft Sentinel environment to the Defender portal
AI-generated content may be incorrect. Read our transparency notes for more information.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.