Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview)

amybook

Microsoft

Oct 20, 2026

Monitor ingestion health, manage connectors, and inspect tables from the new Data & connectors experience in the Microsoft Defender portal.

As security teams bring in more data from more sources and use it across SIEM and XDR workflows, decisions about connector health, ingestion volume, and cost optimization get harder.

Today, we’re announcing the public preview of Unified Data Management for Microsoft Sentinel, available in the new Data & connectors experience in the Microsoft Defender portal, so you can monitor and manage your data from a single place.

What Unified Data Management is and why it matters

Unified Data Management brings connectors, tables, and ingestion health together. Instead of moving between separate pages, you can see your full data landscape, spot issues, and act on them from one view. It’s designed to help you quickly answer questions like:

Which connectors are configured and which need attention?
Which tables are receiving data?
Are there ingestion spikes, drops, or stale data patterns?
Which tables drive the most ingestion volume?
What schema, transformations, and retention settings apply to a table?

You’ll find it under Setup & configuration > Data & connectors, organized into three tabs: Overview, Connectors, and Tables.

Overview: See health at a glance

The Overview tab gives you a workspace-level snapshot of ingestion and health, so you can catch data issues before they impact analytics, detections, investigations, or reporting. It surfaces:

Ingestion volume: Daily ingestion split by Analytics tier and Data Lake tier for your selected time range.
Connectors that need attention: Connectors with credential errors, ingestion failures, or outages, including error type, failure count, and last successful ingestion.
Table ingestion fluctuations: Tables with unexpected volume changes, grouped into spikes and drops.
Data ingestion volume by table: Your top ingesting tables, ranked by daily volume.
Ingestion latency by table: How long it takes for data to become available after it’s generated.

Together, these insights help you troubleshoot connector failures, track down cost spikes, validate that new connectors are flowing, and catch unexpected changes in volume.

Figure 1: The Overview tab shows daily ingestion volume by tier alongside data health insights,
including connectors that need attention and tables with unexpected volume spikes or drops.

Connectors: One inventory for unified and classic connectors

The Connectors tab puts unified data connectors and Sentinel classic data connectors side by side, so it’s easier to see which data sources are onboarded and how they're connected. From here, you can:

View onboarded connectors with their status, provider, content source, and available updates.
Switch between unified connectors and Sentinel classic connectors.
Search and filter connectors by provider, data type, and status.
Open connector details to review configuration and health.

Unified connectors reduce duplication by allowing supported data sources to connect once and feed data across Microsoft security products. Sentinel classic connectors continue to support the broad connector ecosystem, including connectors built with the Codeless Connector Framework (CCF).

Figure 2: The Connectors tab brings unified and Sentinel classic connectors into a single inventory, with counts
for onboarded and connected connectors, available updates, and filters for provider, data type, and status.

Tables: Health, schema, transformations, and retention in one place

The Tables tab brings Microsoft Sentinel and Microsoft Defender XDR tables together with their health signals, schema, transformations, and retention settings.

Key insights now appear right in the grid, so you can compare tables side by side: last data received, average daily ingestion volume, estimated daily ingestion cost, volume anomaly, tier, and retention settings. This makes it easier to spot tables that have gone stale, are growing unexpectedly, or are driving a big share of your ingestion volume.

Select any table to open the details panel, which organizes everything about that table into tabs:

Details panel tab	What it shows
Overview	Table type, tier, analytics retention, total retention, and other table metadata.
Schema	Column names, data types, and descriptions, with no KQL query required.
Transformations	Filter, Split, and Scope Tag transformation rules applied to the table.
Retention	Analytics retention and total retention settings.

Figure 3: The Tables tab opens a details panel for any selected table. The Schema tab is especially useful when you need to
understand incoming data, validate table fields, or create transformation logic without first writing schema-discovery queries.

Built for everyday data operations in the Microsoft Defender portal

Data management touches nearly every part of security operations, from detection and investigation to hunting, retention, and cost optimization. By bringing these tasks into the Microsoft Defender portal, Unified Data Management cuts down on context switching and makes it clearer how connectors, tables, health, transformations, and retention fit together.

It’s one more step in Microsoft Sentinel’s investment in a unified security operations experience, where SIEM and XDR data can be managed and used together.

Preview availability and prerequisites

Unified Data Management is now available in public preview in commercial cloud environments. To experience it, you’ll need:

Microsoft Sentinel onboarded to the Microsoft Defender portal.
Unified role-based access control (URBAC) enabled in the Microsoft Defender portal.
Data (manage) permission in the Data Operations permission group.
Workspace permissions equivalent to Log Analytics Contributor, including permissions to write workspace and table settings.

Get started

Ready to try it? Open the Microsoft Defender portal and go to Setup & configuration > Data & connectors. From there:

Start on the Overview tab to check ingestion volume and data health.
Use the Connectors tab to view your unified and classic connectors.
Explore the Tables tab to review table health, schema, transformations, and retention.

For implementation and configuration guidance, see: