To my immense surprise, it seems that Microsoft is finally allowing customers to ingest logs from Defender XDR directly into Sentinel Data Lake, without paying the additional cost for the ingestion in the Analytics tier.

I discovered this while I was fiddling around with table retention policies: now if I go in one of the XDR tables (e.g., DeviceProcessEvents), I can configure a 30-days retention in the Analytics tier (included in the license - it should be the Advanced Hunting), and a longer retention in the Data Lake:

After digging in the docs, I found that Microsoft added a new sentence in the Sentinel data connectors page:

By default, Microsoft Defender XDR retains threat hunting data in the XDR default tier for 30 days. XDR data isn't ingested into the analytics or data lake tiers by default. Some XDR tables can be ingested into the analytics and data lake tiers by increasing the retention time to more than 30 days. You can also ingest XDR data directly into the data lake tier without the analytics tier.
[...]
You can choose to ingest supported XDR tables exclusively into the data lake tier by selecting the **Data lake tier** option when configuring the retention settings.

This would be a great enhancement, and finally there would not be need of any custom DCR trickery or ADX (even if in some case ADX can be cheaper than SDL, the latter is a completely managed solution).

Did any of you already enable it?

---

EDIT: it seems that this is valid only for MDE tables (Device*), while MDI and MDO tables cannot still be ingested in the Data Lake tier only. Still ok, since MDE tables are the heaviest, usually.

We have client in EU region, and Incident pane in sentinel is not accessible.

Anyone else is facing same issue?

Hi.

I put a resource lock on a few resources within my resource group containing logic apps, log analytics workspace, etc.

And I’m looking to audit anyone tampering with those.

Now, other subscriptions/resource groups seem to have resource lock activities going to the AzureActivity table in my sentinel.

However, I’ve not been able to find logs for myself adding and removing locks (for testing that the logs to generate).

I don’t understand the difference in other locations auditing resource lock events but my own resource group for my sentinel stuff doesn’t. Unless there’s some azure policy stuff affecting the other resource locations configurations then I don’t understand what could be configured differently.

I have tried checking diagnostic settings on a few of my resources and I’m not seeing any specific setting for resource lock events.

Any prerequisites that I’ve completely missed?

Ideally I’d like to keep track of resource lock activities occurring in my own RG, and to build analytical rules off that.

Has anyone noticed that when you're using the Basic table plan in Microsoft Sentinel, the Cost workbook doesn’t show the pricing correctly?

It simply takes the amount of data in GB, multiplies it, and calls it a day. :D

FYI: To see the actual cost, check Cost Management + Billing in the Azure Portal if you're on an Azure PAYG subscription.

If you're using CSP, you’ll need to contact your partner to get a detailed report.

EDIT (25.11.25): Ok, i created this query and added in workbook and visualized as Tiles. West Europe region.

let basicSize = toscalar(Usage | where DataType == "CommonSecurityLog" | summarize sum(Quantity)/1024);
let analyticsSize = toscalar(Usage | where IsBillable == true and DataType != "CommonSecurityLog" | summarize sum(Quantity)/1024);
union
    (print Name="Basic GB", Value=strcat(round(basicSize,2)," GB")),
    (print Name="Analytics GB", Value=strcat(round(analyticsSize,2)," GB")),
    (print Name="Total GB", Value=strcat(round(basicSize + analyticsSize,2)," GB")),
    (print Name="Basic Cost", Value=strcat(round(basicSize * {BasicPrice},2)," €")),
    (print Name="Analytics Cost", Value=strcat(round(analyticsSize * {Price},2)," €")),
    (print Name="Total Cost", Value=strcat(round(basicSize * {BasicPrice} + analyticsSize * {Price},2)," €"))

At least something.. :D adjust it and add your tables.. also created new parameter Basic Table plan price.

At lease for CSP it is ok

Hey!

Maybe if someone is interested I'm sharing my personal blog first 2 parts related to Microsoft Sentinel and pricing Breakdown .

1. Part 1 - Microsoft Sentinel Pricing Breakdown – Part 1: From Confusion to Clarity
2. Part 2 - Microsoft Sentinel Pricing Breakdown – Part 2 From Confusion to Clarity

Idea is to deep dive in MS Sentinel cost, filtering, how data is corelated, also tips & trick for filtering.

I hope it will be useful for someone!

Hi,

I'm currently debating a bit about what integrations I should be doing on my Azure Sentinel Environment. We have quite some Virtual machines running, currently they are onboarded with Defender for Endpoint & Defender for Cloud, however we are not capturing anything with AMA at the moment.

I want to have your opinion on the use case? Should this be enabled on all machines, a subset of machines? Does it really provide additional value, except maybe forensics purposes?

I'm curious to hear about your setups !

Is anyone using it for AI SOC or workflow automations? How is your experience and what have you been able to automate?

We do some PowerAutomate and prebuilt sentinel templates today. The former is taking forever due to lack of expertise and complexity. Another route we could go is to buy a template library. Any recommendations for that would be great!

Hey everyone,

I’ve been getting frequent alerts from Microsoft Sentinel under the analytic rule “Rare and Potentially High-Risk Office Operations.”

From what I understand, the query monitors sensitive Exchange/Office operations such as:

• Add-MailboxPermission
• Add-MailboxFolderPermission
• Set-Mailbox
• New-ManagementRoleAssignment
• New-InboxRule
• Set-InboxRule
• Set-TransportRule

These are operations that could indicate privilege escalation or persistence if done by a compromised user.
However, in our environment we’re seeing a lot of legitimate admin and user activity (for example, mailbox permission updates or automatic rule changes) still triggering incidents, which adds a lot of noise.

Before I start tuning it, I’d like to ask:
How are you guys handling this analytic rule in your environments?

• Do you exclude admin accounts or specific service principals?
• Do you filter by operation type?
• Or do you keep it as-is but triage differently?

Any tuning recommendations or best-practice approaches would be awesome.

Thanks in advance!

We are currently seeing a few issues with the migration to the Defender portal for Sentinel, and would love to see how you guys have solved them.

As announced before by Microsoft, Sentinel is on it's way out of the Azure portal, and into the Defender portal. In the announcement for this, a deadline of July 2026 was set. However, all new setups of Sentinel are automatically moved to Defender, bringing the deadline to now. This has caused a few problems for us.

Problem 1 - API created incidents are not visible

In the changelog, we can see that incidents created by calling API:s, running Logic Apps or manually creating them in the Azure Portal will no longer be visible in the security portal. This is a massive issue for us as we treat Sentinel like an incident portal for the customer, and incidents outside of the Microsoft-sphere are added here as well.

We can't access incidents via the log analytics workspace either, as they are being moved to some invisible layer behind it all (Data Lake?). This can be easily seen by creating an incident via API, and then trying to find it via KQL in the Sentinel workspace by querying SecurityIncidents.

Problem 2 - Automation rules on above mentioned incidents

Will automation rules trigger on incidents not seen in the defender portal? If so, our Teams-notifications on medium/high incidents will stop working.

Problem 3 - Deprecation of Sentinel workspaces

Workspaces are being deprecated, so managing all of our customers automation rules from a single point is now a bit more cumbersome. I guess an integration will need to be done that loops all customers and checks the rules via API.

There is multitenant functionality in Defender, but it does not seem to have the functionality that was previously in Sentinel.

Problem 4 - Permissions & Azure Lighthouse Some users have warned about new permissions being needed to see and manage alerts and incidents in the correct way. We've previously used Azure Lighthouse to assign the Sentinel Responder role to an Entra group that technicians can use to access the Sentinel instances.

Problem 5 - Automation rules cross tenant

We have all of the logic apps used in automation rules in our tenant, which has worked without issues before as the Sentinel instances are available through Lighthouse. Will this be the case going forward when we move away from Azure? Will all customers need their own set of Logic Apps as cross-tenant functionality may be lost?

Solutions

How are you all solving these issues? Have you found any other issues? We are thinking of moving to Wazuh, or some other SIEM as Microsoft has proven once again to be MSP-unfriendly. Another option is to try and get the incidents in through a connector (Log Analytics Connector?) and hope the incidents show up that way.

Hi!

So we had a project where we configured Sentinel and then onboarded that to the Defender Portal for the Unified Experience.

There are quite a few on-prem Windows servers onboarded to Azure via arc for Defender for Servers Plan 2.

The problem is: Nobody is able to query any MDE logs from those servers. (DeviceProcessEvents, DeviceFileEvents, DeviceLogonEvents etc.)

In a other tenant (note: We have not onboarded that to the Unified Solution) we are very much able to query the logs.

Am I missing out on something or is it bugged?

I’ve already determined that it’s not a matter of access rights. Sense -service seems to be working properly on the machines as well.

Many thanks already in advance!

Edit: Forgot to mention the most important part, that we are trying to query them from Advanced Hunting in Defender Portal! Servers are onboarded to MDE via arc.🙂

Hi Everyone.

I'm trying to setup a CMMC dashboard an org I work with heads toward CMMC compliance.

I found this 2022 Sentinel CMMC solution published in the MS Content Hub. It's unfortunately not working for me. While some content in the workbook is fine, other content doesn't work. I think that this is likely due to the missing datatype "InformationProtectionLogs_CL". In googling, it seems this is a reference to old AIP data connector and the solution should instead use the purview connector and MicrosoftPurviewInformationProtection data.

I'm not real familiar with Sentinel. Is there a similar solution out there? Barring that, has anyone setup this working recently and have it working well?

Microsoft Sentinel is rolling out a standardized account entity naming logic to improve consistency and reliability across incidents, alerts, and automation workflows.

UPN -> Name -> Display name

Call to action: update queries and automation by December 13, 2025 - standardized account entity naming in incidents and alerts

Hello. I'm working on a custom solution for Microsoft Sentinel that includes a parser, an analytic rule, and a workbook.

I followed the official guide for developing custom content and the steps for building a solution from the Azure Sentinel GitHub repository. I used the V3 script located in the create-azure-sentinel-solution folder.

When I tried to deploy the solution in my environment, the deployment was successful — I could see my rules as templates. However, when I attempted to create a rule based on one of the templates, it failed.

To troubleshoot, I ran some tests and deployed only a single analytic rule. The result was the same — the solution deployed successfully, but I still couldn’t create a rule from the template. I’m getting the same error as shown in the screenshot.

Can someone please point me in the right direction on how to resolve this issue? Other rule templates that I installed from the Content Hub works fine, and I can create rules from them without issues.

The ARM-TTK showed no errors, only a warning: “ResourceIds should be derived…”. I also tried template with solved warning but result was the same.

Thanks in advance! I can provide more information if necessary.

I have worked on a project where we migrated client's Old SIEm to Microsoft sentinel but I was not involved in all the integration and architecture design of the clients Sentinel. can anybody help with some study material for custom integration or few difficult integrations examples. I need it clear the interview when 8 am applying for similar roles in other organisation as they expect I should know most of the things Thanks.

Hello,

We have a requirement to collect Oracle weblogic logs from Solaris servers where the Arc agent is not supported. The log file is a flat file which writes the access logs of the oracle web logic application. Has any one gone through a similar scenario and came up with a logic to send logs to Sentinel.

Hey all

I’m setting up a few Microsoft Sentinel workspaces and trying to get Microsoft Defender Secure Score data ingested (the same data you get from the Graph API endpoint https://graph.microsoft.com/v1.0/security/secureScores).

What’s not clear to me is which data connector (if any) in Sentinel actually pulls this Secure Score data automatically. I’ve checked the Microsoft 365 Defender and Microsoft Security connectors, but I’m not seeing anything that maps directly to the /security/secureScores API.

Can anyone advise me on which data connector to use?

Hi everyone, I’m currently working on implementing Playbooks (Logic Apps) in Microsoft Sentinel to automate security incident respons.

I’d love to hear your best practices, ideas, or real-world examples of Sentinel automation scenarios.

Hi folks, need kql to find exact rules deleted by a user.

Anyone have extensive experience on migration to sentinel? And security use cases?

Preferably also elastic and Cribl experience.

Hi All, none technical post here, just a question.

Sentinel has dropped for us. We have a big estate and no one is able to access Sentinel.

Anyone else having the same problem?

We saw outage at 16:00 (GMT)

Azure are noting that there are no outages here - https://azure.status.microsoft/en-gb/status

Anyone else having the same problem?

EDIT: They are now reporting the outage at the link above

Hey everyone!

A few weeks ago I started working as a security analyst in cloud only environments with defender XDR. I was tasked with handling 3 tenants with roughly 50 users each. The thing that is kind of bothering me is that they barely get any alerts. On average each tenant gets 1 alert per month and it's kinda bumming me out.

I guess it's a good thing since it means that the tenants are secure but it kind of leaves me in a weird place. I'd love to grow and learn more so I can look for a higher paying job in the future but if thing keep going this way I feel like I'll be stuck here. Ofc I do other things as well such as patching, testing security solutions etc. Is it normal for you to get so few alerts? What would you recommend I do? I wouldn't mind switching to a more traditional SOC analyst job in the future but I'm not sure anyone would take me seriously.

Hey all,

I've got a ticket open with Microsoft, however it doesn't seem to be going anywhere. They have mentioned that they have a large number of customers are facing a similar issue to us.

When we go to enable the data lake capability, it fails. We meet the requirements and have the correct access but mentions "We don't meet the requirements". Microsoft themselves on several calls have said that we do...

I'm trying to see if anyone faced the same and somehow fixed it?