Microsoft Secure Tech Accelerator
Apr 03 2024, 07:00 AM - 11:00 AM (PDT)
Microsoft Tech Community
SOLVED

How to delete sentinel

Brass Contributor

Hi Team,

I have created one sentinel and connected to ALA in LAB. Now i want to remove them.

So could anyone help me how to delete sentinel from subscription.

 

And one more thing if anyone can shed any link or other stuff to configure sentinel in production.

I have gone through MS blogs however it would be great if i will have something for deep-dive.

 

Thanks in advance! 

3 Replies

Hey @GouravIN 

 

If you want to remove Sentinel, you can just delete the workspace.  First, go to the workspace settings within Sentinel (attachment #1).

 

Then press the 'Delete' button on the top when the page loads (attachment #2).  Note that this will delete your data in the workspace and all other configurations.

 

If you want to just delete a data source you can disconnect them individually in the 'Data Connectors' page.

 

We hope this help!

 

Andrew

best response confirmed by GouravIN (Brass Contributor)
Solution

@GouravIN 

 

An additional procedure you can use is to remove the sentinel solution from the Workspace and  restore it to be a Log Analytics workspace. Any Sentinel configuration such as connectors and alert rules will be deleted, but the data will be kept in the Workspace and can be used through the Log Analytics workspace.

 

To do that:

  1. Select "Workspace settings"
  2. Select "Solutions"
  3. Select the SecurityInsights solutions
  4. Use the delete button at the top
Hello Team, Please use below link for more information
https://learn.microsoft.com/en-us/azure/sentinel/offboard

It may help...
1 best response

Accepted Solutions
best response confirmed by GouravIN (Brass Contributor)
Solution

@GouravIN 

 

An additional procedure you can use is to remove the sentinel solution from the Workspace and  restore it to be a Log Analytics workspace. Any Sentinel configuration such as connectors and alert rules will be deleted, but the data will be kept in the Workspace and can be used through the Log Analytics workspace.

 

To do that:

  1. Select "Workspace settings"
  2. Select "Solutions"
  3. Select the SecurityInsights solutions
  4. Use the delete button at the top

View solution in original post