Reminder: Following the Retirement Announcement published in March 2023, classic alert‑trigger automation in Microsoft Sentinel, where playbooks are triggered directly from analytic rules will be deprecated in March 2026. To ensure your alert‑driven automations continue to run without interruption, please migrate to automation rules.
How to Identify the Impacted Rules
To help you quickly identify if any analytic rules should be updated, we created a Logic App solution that identifies all the analytic rules which use classic automation. The solution is available in two deployment options:
- Subscription-level version – scans all workspaces in the subscription
- Workspace-level version – scans a single workspace (useful when subscription Owner permissions are not available)
Both options create an output of a list of analytic rules which need to be updated as described in the next section.
The solution is published as part of Sentinel's GitHub community solutions with deployment instructions and further details:
sentinel-classic-automation-detection
After deploying and running the tool, open the Logic App run history. The final action contains the list of the analytic rules which require migration.
How to Migrate the identified Analytic Rules from Classic Alert‑trigger Automations
Once you have identified the analytic rules using classic automation, follow the official Microsoft Learn guidance to migrate them to automation rules:
migrate-playbooks-to-automation-rules
In short:
- Identify classic automation in your analytic rules
- Create automation rules to replace the classic automation
- To complete the migration, remove the Alert Automation Classic Actions identified in step #1 by clicking on the three dots and 'Remove'
Summary
- Classic automation will retire in March 2026
- Use the detection tool to identify any remaining classic alert-trigger playbooks
- Follow the official Microsoft documentation to complete the required changes
- Act now to ensure your SOC automations continue to run smoothly
Microsoft