{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-guides/sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":["admonition"]},"type":"markdown"},"seo":{"title":"Microsoft Sentinel: Migrating to the Defender Portal","siteUrl":"https://docs.synqly.com","lang":"en-US","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"microsoft-sentinel-migrating-to-the-defender-portal","__idx":0},"children":["Microsoft Sentinel: Migrating to the Defender Portal"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Microsoft is consolidating Microsoft Sentinel into the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://security.microsoft.com"},"children":["Microsoft Defender portal"]}," and requires all Sentinel workspaces to transition by ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["March 31, 2027"]},". Workspaces created after July 2025 are automatically connected."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Defender portal connection is required to enable the full Synqly feature set for Microsoft Sentinel, including alerts. If your workspace is not connected, some Synqly capabilities will be unavailable."]},{"$$mdtype":"Tag","name":"Admonition","attributes":{"type":"info","name":"No Additional Cost"},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Transitioning to the Defender portal has no extra cost and does not require a Microsoft Defender XDR or E5 license. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/azure/sentinel/microsoft-sentinel-defender-portal"},"children":["Microsoft's documentation"]}," for details."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"check-your-current-status","__idx":1},"children":["Check Your Current Status"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sign in to the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://security.microsoft.com"},"children":["Microsoft Defender portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["System"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Microsoft Sentinel"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If your workspace appears in the list, it is already connected — no further action is needed"]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Security Administrator"]}," (or higher) in Microsoft Entra ID"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Owner"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["User Access Administrator"]}," on the Azure subscription containing the Sentinel workspace"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Microsoft Sentinel Contributor"]}," on the workspace"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For full prerequisites, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/unified-secops/microsoft-sentinel-onboard"},"children":["Connect Microsoft Sentinel to the Defender portal"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"connect-your-workspace","__idx":3},"children":["Connect Your Workspace"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Sign in to the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://security.microsoft.com"},"children":["Microsoft Defender portal"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["System"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings"]}," → ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Microsoft Sentinel"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connect a workspace"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select the Sentinel workspace and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Next"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Designate it as the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Primary workspace"]}," (if this is your first or only workspace)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Review the summary and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connect"]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The connection typically completes within a few minutes. For multi-workspace scenarios, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/azure/sentinel/move-to-defender"},"children":["Configure multi-workspace management"]},"."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"update-your-synqly-integration-permissions","__idx":4},"children":["Update Your Synqly Integration Permissions"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["After connecting to the Defender portal, ensure your Entra application has the full set of permissions described in the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/guides/provider-configuration/microsoft-sentinel-siem-setup"},"children":["Microsoft Sentinel SIEM Configuration Guide"]},". If your application was created before this migration, it may be missing permissions required for newer features."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"what-to-expect","__idx":5},"children":["What to Expect"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connecting to the Defender portal changes how incidents, alerts, analytics rules, and automation work in your Sentinel environment. Microsoft provides detailed guidance on these changes:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/azure/sentinel/move-to-defender"},"children":["Transition your Microsoft Sentinel environment to the Defender portal"]}," — comprehensive walkthrough of what changes, including incidents, automation, and advanced hunting"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/defender-xdr/alerts-incidents-correlation"},"children":["Alert correlation and incident merging"]}," — how the Defender engine groups alerts into incidents"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://learn.microsoft.com/en-us/unified-secops/overview-plan"},"children":["Plan for unified security operations"]}," — planning guide covering prerequisites, permissions, and deployment"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Your existing Synqly integration configuration (credentials, workspace settings, ingestion pipeline) continues to work without changes. Only the permission addition above is required."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"timeline","__idx":6},"children":["Timeline"]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Date"},"children":["Date"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Milestone"},"children":["Milestone"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["July 2025"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["New Sentinel workspaces are automatically connected to the Defender portal"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":["March 31, 2027"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["Microsoft Sentinel will no longer be supported in the Azure portal"]}]}]}]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["We recommend connecting your workspace at your earliest convenience."]}]},"headings":[{"value":"Microsoft Sentinel: Migrating to the Defender Portal","id":"microsoft-sentinel-migrating-to-the-defender-portal","depth":1},{"value":"Check Your Current Status","id":"check-your-current-status","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Connect Your Workspace","id":"connect-your-workspace","depth":2},{"value":"Update Your Synqly Integration Permissions","id":"update-your-synqly-integration-permissions","depth":2},{"value":"What to Expect","id":"what-to-expect","depth":2},{"value":"Timeline","id":"timeline","depth":2}],"frontmatter":{"slug":"guides/provider-configuration/microsoft-sentinel-defender-migration","seo":{"title":"Microsoft Sentinel: Migrating to the Defender Portal"}},"lastModified":"2026-04-28T16:29:57.000Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/provider-configuration/microsoft-sentinel-defender-migration","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}