Microsoft Sentinel auto-resolving to "Simple mode" rather than "KQL mode".

Arthur Williams 0 Reputation points
2026-11-04T05:29:44.0066667+00:00

Regardless of the setting being enabled to "Select the mode you would like Log Analytics to be in default" - see attached image - sentinel has recently been automatically opening Log Analytics in simple mode. Whilst this obviously isn't a huge issue, having to manually change from simple mode to KQL mode every time I open log analytics is an irritating feature that should be avoidable with the provided setting.

User's image

Microsoft Security | Microsoft Sentinel
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.