Microsoft Sentinel
Microsoft Sentinel is Microsoft's cloud-native SIEM with built-in SOAR. It collects security data from Microsoft and other sources across clouds and on-premises, detects threats with analytics rules and hunting, and automates response with Logic Apps playbooks. Its data lake tier keeps data for up to 12 years.12
Also known as Microsoft Sentinel SIEM, Sentinel
- Intended for
- Security operations (SOC) analysts and threat hunters, Security engineers who manage log ingestion, Managed security service providers, Compliance teams with log retention duties
- Runs on
- Azure cloud service on Log Analytics workspaces, Microsoft Defender portal (Azure portal until 31 March 2027), Multicloud and on-premises sources through connectors, Multi-tenant management with Azure Lighthouse
At a glance
- What is it?
- Microsoft Sentinel is a cloud SIEM that runs on Azure Monitor Log Analytics workspaces. It ships security content as solutions in a content hub (connectors, analytics rules, workbooks and playbooks), normalizes data with the Advanced Security Information Model (ASIM) and supports Azure Lighthouse for service providers. The Microsoft Sentinel data lake adds a second, lower-cost storage tier in open Parquet format, queried with KQL and Jupyter notebooks. Sentinel is generally available in the Microsoft Defender portal, including for customers without Defender XDR or an E5 license, and Microsoft is moving every customer there: after 31 March 2027 it will no longer be supported in the Azure portal.12
- What does it do?
- It ingests logs through out-of-the-box connectors, Syslog, CEF, REST APIs and custom connectors; groups alerts into incidents with built-in or custom analytics rules; maps detection coverage to MITRE ATT&CK; and correlates events with threat intelligence and watchlists. Analysts investigate with an entity graph, hunting queries and notebooks. Automation rules and playbooks built on Azure Logic Apps carry out response steps, such as opening a ServiceNow ticket for each new incident. A Sentinel MCP server exposes data lake queries, graphs and triage tools to AI agents.13
- Who needs it?
- Security operations teams that must collect and correlate logs from many sources, such as firewalls, other clouds, identity providers like Okta and on-premises systems, and keep them for investigations or regulation. It suits organizations that want a hosted SIEM billed on Azure consumption instead of running their own SIEM infrastructure, and service providers that manage several customer tenants through Azure Lighthouse.1
- What does it need?34
- An Azure subscription and an Azure Monitor Log Analytics workspace
- Owner or User Access Administrator rights for automatic onboarding to the Defender portal
- Connectors for each data source; some use Azure Functions, which are billed separately
- Azure Logic Apps for playbooks, billed separately
- A supported region if you use the Sentinel data lake
- What it is not
- Sentinel is not an endpoint or email protection product; it analyzes data that other tools produce. It is not free with Microsoft 365 E5: ingestion and analysis are billed on Azure, although some data, such as Azure Activity logs, Office 365 audit logs and alerts from Defender products, is free. The product is not being retired: only the Azure portal experience ends after 31 March 2027, when Sentinel will be available only in the Microsoft Defender portal.3
Availability and licensing. Checked 26 Oct 2026: billed on an Azure subscription, pay-as-you-go or with commitment tiers that start at 100 GB per day; data lake ingestion, processing, storage, queries and notebook compute have separate meters. A 31-day free trial covers the first 10 GB per day. Analytics tier retention is included for 90 days. The Learn pages give no per-GB prices; Microsoft points to its pricing page and cost estimator. Sentinel is supported in the Azure portal until 31 March 2027 and afterwards only in the Defender portal.34
The problem it solves
Security teams need one place to collect logs from many systems, keep them long enough for investigations and audits, and detect threats that only show up when events from several sources are combined. Traditional SIEMs force a choice between how much data you keep and what it costs.
Sentinel answers with a hosted SIEM split into two tiers: an analytics tier for real-time detection and a data lake tier that keeps a single copy of high-volume data at lower cost, with jobs that promote data back to the analytics tier when needed.2
How it works
Data flows from connectors into a Log Analytics workspace enabled for Sentinel. From there:
- Analytics tier: high-performance storage for detection rules, hunting, alerting and incidents; the first 90 days of retention are included.
- Data lake tier: a mirrored single copy of data in Parquet format for up to 12 years, queried with KQL and Jupyter notebooks, with one-time or scheduled jobs that promote results to the analytics tier.
- Detection and investigation: analytics rules, MITRE ATT&CK coverage, threat intelligence, watchlists, entity graphs, hunting queries and workbooks.
- Response: automation rules that trigger Logic Apps playbooks.
- AI access: the Sentinel MCP server lets agents query the lake and graphs; the Security Analyst Agent in Security Copilot can analyze Sentinel data.
Since July 2025, new customers who onboard the first Sentinel workspace in a tenant with Owner or User Access Administrator rights are onboarded to the Defender portal automatically.1236
Diagram as a list
Copilot & business apps
- Microsoft Defender portalWhere analysts handle Sentinel and Defender incidents togetherConnects to Analytics rules, threat intelligence and watchlists
Agents & automation
- Sentinel MCP serverExposes lake, graph and triage tools to AI agentsConnects to Microsoft Sentinel data lake
AI models & platform
- Security CopilotIncident summaries and analysis over Sentinel data
Data & analytics
- Data sources (Microsoft, other clouds, on-premises, SaaS)Send logs through connectors, Syslog, CEF or RESTConnects to Data connectors and content hub solutions
- Data connectors and content hub solutionsIngest and normalize data with ASIM
- Analytics tier (Log Analytics workspace)Real-time detection, hunting and incidents
- Microsoft Sentinel data lakeLong-term Parquet copy for KQL jobs, notebooks and graphsConnects to Analytics tier (Log Analytics workspace)
Security, identity & governance
- Analytics rules, threat intelligence and watchlistsCreate alerts and group them into incidents
- Automation rules and Logic Apps playbooksRun response actions and open tickets
Capabilities
Data collection and normalization13
Out-of-the-box connectors packaged in content hub solutions, Syslog, CEF, REST API and custom connectors, with ASIM normalization at query or ingestion time.
Why it matters: Brings Microsoft and non-Microsoft data into one queryable store.
Limits: Some connectors use Azure Functions with separate costs, and raw logs for several Defender and Entra data types are paid.
Analytics and threat detection1
Built-in and custom analytics rules group alerts into incidents; MITRE ATT&CK coverage views, threat intelligence and watchlists add context.
Why it matters: Reduces alert noise by combining low-fidelity alerts into higher-fidelity incidents.
Limits: Rules need tuning to the environment, which takes analyst time.
Investigation and hunting1
Interactive entity graphs, MITRE-based hunting queries that can become detection rules, and Jupyter notebooks in Azure Machine Learning workspaces.
Why it matters: Finds root causes and threats before an alert fires.
Limits: Notebook compute in Azure Machine Learning is billed separately.
SOAR with automation rules and playbooks1
Automation rules manage incident handling centrally and trigger playbooks built on Azure Logic Apps, with connectors such as ServiceNow and Jira.
Why it matters: Makes repeat response steps consistent and fast.
Limits: Logic Apps runs are charged at Logic Apps prices.
Sentinel data lake23
Open Parquet storage for up to 12 years, KQL queries and jobs, scheduled Jupyter notebooks in 12, 32 or 80 vCore pools, and an audit log of lake activity.
Why it matters: Keeps high-volume logs at lower cost while staying queryable.
Limits: Data lake ingestion, processing, storage, queries and notebook compute each have their own meter; check regional support.
Graphs and MCP server for agents3
Custom graphs built from lake data and a Sentinel MCP server with data exploration, triage and graph tool collections for AI agents.
Why it matters: Lets AI agents and analysts reason over relationships between users, devices and activity.
Limits: The MCP server is free, but lake queries, graph compute and the entity analyzer (which uses Security Compute Units) are billed.
Defender portal experience1
Sentinel is generally available in the Microsoft Defender portal, even without Defender XDR or an E5 license, alongside Defender incidents.
Why it matters: One portal for SIEM and XDR work.
Limits: Azure portal support ends after 31 March 2027; Azure Lighthouse-delegated users are not onboarded automatically.
Practical use cases
Firewall, cloud and identity logs from several vendors sit in separate tools and cannot be correlated.
- Approach
- Connect the sources to a Sentinel workspace, enable built-in analytics rules from content hub solutions and investigate incidents in the Defender portal.
- Role of Microsoft Sentinel
- Sentinel is the central SIEM for detection and investigation.
- Data, infrastructure and skills
- An Azure subscription, connectors for each source and analysts to tune rules.
- Type of benefit
- Broader detection coverage
- Caveats
- Ingestion volume drives cost; choose free and paid data types per connector.
- First step
- Use the 31-day free trial on one workspace with a few key sources.
Auditors require security logs to be kept for years, but keeping them in the SIEM tier is expensive.
- Approach
- Move high-volume, low-value tables to the data lake tier and keep detection-relevant tables in the analytics tier.
- Role of Microsoft Sentinel
- The data lake tier stores one copy for up to 12 years and supports KQL queries and promotion jobs.
- Data, infrastructure and skills
- Data lake onboarding in a supported region.
- Type of benefit
- Lower storage cost
- Caveats
- Lake queries are billed per GB of data scanned.
- First step
- Review table tiers and retention under Data management > Tables.
Analysts repeat the same manual steps for every incident, such as opening tickets.
- Approach
- Write automation rules that trigger Logic Apps playbooks for common incident types.
- Role of Microsoft Sentinel
- Sentinel orchestrates the response steps.
- Data, infrastructure and skills
- Logic Apps connectors for your ticketing and identity systems.
- Type of benefit
- Consistent response
- Caveats
- Logic Apps usage has its own charges.
- First step
- Start with one playbook that opens a ticket for each high-severity incident.
Works with
Optional integration
- Microsoft Defender XDRSentinel runs in the Defender portal, and Defender XDR alerts and incidents are free data sources.
- Microsoft Security CopilotSecurity Copilot analyzes Sentinel data, and the MCP entity analyzer consumes Security Compute Units.
- Azure Machine LearningSentinel notebooks run in Azure Machine Learning workspaces.
Complementary tools
- Microsoft PurviewSentinel graphs power Insider Risk Management and Data Security Investigations views in Purview, and Purview DSPM can use the Sentinel data lake for partner data (preview).
Optional integration for
- Microsoft Defender XDRSentinel runs in the Defender portal, and Sentinel connectors enable Okta and AWS disruption actions (preview).
- Microsoft Security CopilotWorks with Sentinel data; E5 and E7 SCUs can be used for Sentinel scenarios.
- Azure ArcArc-enabled servers can send security events to Microsoft Sentinel.
- Microsoft PurviewDSPM can use the Sentinel data lake for partner data (preview), and Sentinel graph powers Purview insider risk views.
Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.
Compared with
Getting started
Start the free trial
Enable Sentinel on a Log Analytics workspace; ingestion and analysis of the first 10 GB per day on the Analytics logs plan are free for 31 days, with a limit of 20 trial workspaces per tenant.
Check: The free trial tab under News & guides shows the trial dates.
Onboard to the Defender portal
Connect the workspace to the Microsoft Defender portal; this happens automatically for new tenants when the onboarding user has Owner or User Access Administrator rights.
Check: Sentinel pages appear in the Defender portal.
Connect data
Install content hub solutions for key sources and choose which free and paid data types each connector collects.
Check: Data reaches the expected tables and the built-in workbooks show it.
Turn on detection and response
Enable built-in analytics rules, then add an automation rule that runs a Logic Apps playbook.
Check: Incidents are created and the playbook run appears in its run history.
Official resources
Deciding whether you need it?
Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Sentinel or any new technology is not needed.
Sources
Each statement above links to the source it comes from. Labels say who reported it.
- What is Microsoft Sentinel SIEM? (opens in a new tab)
- Microsoft Sentinel data lake overview (Microsoft Learn) (opens in a new tab)
- Plan costs and understand pricing and billing for Microsoft Sentinel (Microsoft Learn) (opens in a new tab)
- Microsoft Sentinel product page (opens in a new tab)
- Integrated Security Operations Center (ISOC) in Microsoft Defender (opens in a new tab)
- Deploy AI agents in Microsoft Defender (Microsoft Learn) (opens in a new tab)
- Learn about Security Copilot for Microsoft 365 E5 and E7 customers (opens in a new tab)
- Learn about Microsoft Purview Data Security Posture Management (Microsoft Learn) (opens in a new tab)
Thank you. Your correction was sent.
The editors check it against the sources. If you left an email address, they may reply about it.