Monthly news - July 2026

Hello!
Thanks for your reply, appreciated.
That clears up one thing: How to create the Bicep file (*.bicep) and that our Repository now needs to add the bicepsettings.json file in root and with the extension added. So this introduces a complete new file (bicep). No other resource has been in bicep before for Azure DevOps (or github) repository connections:  

https://learn.microsoft.com/en-us/azure/sentinel/ci-cd-custom-content#plan-your-repository-content

Thats ok, but when i started reading up on bicep, apprently the Repository connection have to be newer then 1 November 2024 as stated here:

https://learn.microsoft.com/en-us/azure/sentinel/ci-cd?tabs=github

"This procedure describes how to remove the connection to a source control repository from Microsoft Sentinel. In order to use Bicep files, your repository connection must be newer than November 1, 2024. Use this procedure to remove the connection and recreate it in order to update the connection."

Working in a MSSP with around 25-75 connections, many of which are created before that date, this becomes a massive undertaking. We where reassured in many other blogposts and partner programs that only editing the existing connections where enough to get the full support (And custom detections files will start to appear in content hub in sentinel). Im starting to feel what i feared, a huge undertaking starting this fall to recreate all our connections and introduce the bicep extension support to Azure DevOps. (i would LOVE not to use bicep, ARM is already natively supported).

I also did a new fresh connection, as i had a gut feeling that the *.ps1 deployment file that is generated when a new connection is set up (that still dosent work correctly with workingdirectories btw) had some new items in them, for both bicep AND custom detections - and yes, it had.... I have rewritten the whole file by hand to support proper versioning, renaming of workbooks AND workingdirectories for customers (biggest issue with default ps1 was that a full deployment is forced as soon as you change any customer folder, making a full redployment taking 20-30min per customer on ANY minor change). Now i need to spend a few days diffing the files to add the new custom detection items... Would be GREAT if these infrastructure files that are generated upon such connections would be publicly available and maintained by Microsoft - that would be awesome and great (then i dont need to redeploy/connect a tenant to see them).


Thank you <3 , i will try all these when vacation starts to wind down, this is a massive undertaking but i think i have the basis to begin exploring both Bicep support, but also custom detections (i have built a firefox extension that can handle mass deployment of custom detections). But i will have to convert that to support a bicep EXPORT :)

Thanks again, appreciated coming back to me!!