Explore Our Microsoft Cloud Security Training →
In July 2026, Microsoft will retire the Azure portal for its security information event management (SIEM) solution, Microsoft Sentinel. This move is part of a larger effort to consolidate security solutions within the Defender portal. As an IT admin or SOC team member using Microsoft Sentinel, it’s essential to understand how this change will impact your workspaces and prepare accordingly.
After the transition, existing Sentinel workspaces will be moved to the Defender portal. This shift may require adjustments to your automation rules, playbooks, and alert configurations. To ensure a smooth transition, we recommend following these steps:
1. Review the transition guide: Start by reviewing Microsoft’s Sentinel to Defender portal transition guide. This resource will provide detailed information about the migration process and help you understand what changes to expect.
2. Onboard your workspace: To avoid disruptions, we recommend onboarding your Sentinel workspace to the Defender portal as soon as possible. This step can be completed by following the instructions in Microsoft’s guide.
3. Retrain SOC analysts: As part of the transition, your security operations center (SOC) team may need additional training on the Defender portal. Make sure to allocate time for retraining and provide resources to help analysts adapt to the new interface.
4. Validate automation rules and playbooks: After migrating your workspace, validate that all automation rules and playbooks are functioning as expected in the Defender portal.
If you manage multiple tenants using Azure Lighthouse or as a managed service provider (MSSP), be aware that these changes may affect your multi-tenant management capabilities. Microsoft is working to address these concerns, so keep an eye on their documentation for updates.
5. Create a checklist: To help ensure a smooth transition, create a checklist of tasks to complete before the deadline. This checklist should include steps for migrating workspaces, retraining analysts, validating automation rules, and addressing any potential issues that may arise during the migration process.
By preparing for this change now, you can ensure a seamless transition when the Sentinel Azure portal retires in July 2026. For comprehensive training on Microsoft Sentinel and other cloud security solutions, visit our Cloud Security Training pages.
Explore Our Microsoft Cloud Security Training →
Written by Mohammed Akhter
Founder of ITP Training. 50,000+ students trained across 30+ countries in Microsoft endpoint and cloud security. Learn more →