Blog Post

Microsoft Sentinel Blog
1 MIN READ

Microsoft Sentinel at Ignite 2026: what to see and where to start

jevontan's avatar
jevontan
Icon for Microsoft rankMicrosoft
Nov 11, 2026

Agentic security is only as effective as the security data it can access. That is why Microsoft Sentinel is a core part of the integrated SOC (ISOC), where SIEM and XDR work together with Microsoft Defender. At Ignite 2026, November 17 to 20 in San Francisco and online, see how the pieces come together and what is new.

What to look for: the blueprint for the Agentic SOC, featuring Rob Lefferts, CVP of Defender (BRK324); what is new with ISOC and expanded SIEM capabilities, shown in a live demo (THR876); and how richer security data from Microsoft and third party sources improves detection, investigation and AI workflows (LTG1230). Times, rooms and links are in our session guide, sorted by role: Catch Microsoft Defender and Sentinel at Ignite 2026.

Updated Nov 11, 2026
Version 1.0

1 Comment

  • john66571's avatar
    john66571
    Iron Contributor

    There are so much new stuff in the portals, tables, rights, urbac and more! gonna be a very interesting ignite this year! :)
    One thing, new deployments of Sentinel automatically turned them into ISOC (we did not enable it, it automatically did so) - but we can not modify retention times on the whole workspace OR the tables individually on ISOC enabled Sentinel ("retention times can not be modified on a ISOC enabled"). Hope to see this news on Ignite! its a must, both of these options!!