The leaver who never left: tuning a Sentinel detection from 103 rows to one alert
Most account compromise detections look for something odd: a new country, an impossible journey, or a sign-in at 3 AM. I wanted to catch a case where nothing looks odd at all. Someone leaves the organisation. HR knows, their manager knows, but the request to disable their account sits in a queue or never gets raised. A week later, they sign in from the same laptop, on the same Wi-Fi, into the same apps they used every day. To Entra ID, that is a normal sign-in. Location rules have nothing to catch because nothing has changed. I started from a threat model for a hospital running Microsoft 365. Of the threats I scored, this one stood out because it requires no advanced skill. The person already has a password that works. The only signal is that they are not supposed to be there anymore, and that fact lives with HR, not in the logs. So, the detection has to bring that context into Microsoft Sentinel. Writing it in plain words first Before writing any KQL, I defined exactly what the rule should do: • When an account signs in successfully • AND it is on HR's leavers list • AND the sign-in is after their leave date • THEN raise one High-severity alert per person • EXCEPT when IT is already closing the account, or the person has been rehired The sign-ins are in SigninLogs. For the leavers list, I used a Sentinel watchlist: a CSV with two columns, UserPrincipalName and LeaveDate. To test it, I put my own account on the list with a leave date in the past, so every sign-in after that date should trigger. Version 1 let Leavers = _GetWatchlist('Leavers') | project UPN = tolower(tostring(SearchKey)); SigninLogs | where TimeGenerated > ago(7d) | where ResultType == "0" | where tolower(UserPrincipalName) in (Leavers) | project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location It worked, and that was the problem. It returned 103 rows for one person: every token refresh, every app. An analyst opening that incident would scroll through a hundred near-identical lines to learn one thing: this person is still getting in. It also ignored the leave date, so it would fire on sign-ins from before someone left as well. Version 2 I made two changes: only count sign-ins after the leave date, and summarise per person instead of listing every event. The result was one row: 103 sign-ins, the first and last time seen, the 4 apps used, and the 2 IP addresses. That is exactly what an analyst needs to decide what to do next. The bug that took the longest Version 2 failed with this error: Failed to resolve scalar expression named 'LeaveDate' The column was clearly there. I could see it in the watchlist. I rewrote the query more than once before I looked at the raw Watchlist table and saw the column was actually called " LeaveDate", with a leading space. The CSV had been saved with a space after each comma. The header looked fine to me, and Sentinel took it literally. The fix was to read the Watchlist table directly, use coalesce() to accept either spelling of the column, and trim() to strip spaces from the values. The bigger lesson: lists from other teams will not always be clean, and a detection should cope with that rather than break. The final query let Leavers = Watchlist | where TimeGenerated > ago(90d) | where WatchlistAlias == "Leavers" | summarize arg_max(TimeGenerated, *) by _DTItemId | where _DTItemStatus != "Delete" | extend RawDate = coalesce(tostring(WatchlistItem["LeaveDate"]), tostring(WatchlistItem[" LeaveDate"])) | project UPN = tolower(trim(@"\s", tostring(SearchKey))), LeaveDate = todatetime(trim(@"\s", RawDate)); SigninLogs | where TimeGenerated > ago(7d) | where ResultType == "0" | extend UPN = tolower(UserPrincipalName) | join kind=inner Leavers on UPN | where TimeGenerated > LeaveDate | summarize SignIns = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Apps = make_set(AppDisplayName), IPs = make_set(IPAddress) by UPN, LeaveDate arg_max keeps only the latest version of each watchlist row, and the _DTItemStatus filter drops rows that have been deleted, so someone taken off the list stops alerting. What I would add before using it for real • Feed the list from the HR system instead of uploading a CSV by hand. A list that is two weeks out of date has the same gap as no list. • Build in the exceptions: accounts IT is already closing, and rehires. • Make it a scheduled rule: hourly, 7-day lookback, High severity, with the user mapped as an account entity so the incident links to anything else that account has done. • Check the data is arriving. In the same lab, I found three log sources that had been silent for a month with no error anywhere. A detection is only as good as the data under it. The queries and notes are available on my GitHub: github.com/RabiatuMohammed/sentinel-detections Update: catching the re-enable, not just the sign-in After publishing this, I tested a worse version of the problem. I disabled a test account, watched it get refused at sign-in, then switched it back on. Two minutes later, it was signed in again. 13:11 - Account disabled (AuditLogs: Disable account) 13:15 - Sign-in refused (SigninLogs: 50057, account disabled) 13:29 - Account re-enabled (AuditLogs: Enable account) 13:31 - Signed in again (SigninLogs: 0, success) The rule above only fires at 13:31, after they are back in. The moment that actually matters is 13:29. Disabling the account was the right ending, so switching it back on needs a reason. So, I wrote a second rule that watches for "Enable account" on anyone on the leavers list, and shows who did it: AuditLogs | where OperationName == "Enable account" | extend UPN = tolower(tostring(TargetResources[0].userPrincipalName)), EnabledBy = coalesce(tostring(InitiatedBy.user.userPrincipalName), tostring(InitiatedBy.app.displayName)) | join kind=inner Leavers on UPN | where TimeGenerated > LeaveDate | project TimeGenerated, UPN, LeaveDate, EnabledBy Against the test, it returned one row at 13:29, two minutes before the sign-in. One thing surprised me: the sign-in screen told the user the account was locked, but the log said disabled (50057). Locked would have been 50053. I now go by the error code, not by what the user says they saw. The full query is available on GitHub as DET-LEAVER-02.Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers
In November 2023, Microsoft announced our strategy to unify security operations by bringing the best of XDR and SIEM together. Our first step was bringing Microsoft Sentinel into the Microsoft Defender portal, giving teams a single, comprehensive view of incidents, reducing queue management, enriching threat intel, streamlining response and enabling SOC teams to take advantage of Gen AI in their day-to-day workflow. Since then, considerable progress has been made with thousands of customers using this new unified experience; to enhance the value customers gain when using Sentinel in the Defender portal, multi-tenancy and multi-workspace support was added to help customers with more sophisticated deployments. Our mission is to unify security operations by bringing all your data, workflows, and people together to unlock new capabilities and drive better security outcomes. As a strong example of this, last year we added extended posture management, delivering powerful posture insights to the SOC team. This integration helps build a closed-loop feedback system between your pre- and post-breach efforts. Exposure Management is just one example. By bringing everything together, we can take full advantage of AI and automation to shift from a reactive to predictive SOC that anticipates threats and proactively takes action to defend against them. Beyond Exposure Management, Microsoft has been constantly innovating in the Defender experience, adding not just SIEM but also Security Copilot. The Sentinel experience within the Defender portal is the focus of our innovation energy and where we will continue to add advanced Sentinel capabilities going forward. Onboarding to the new unified experience is easy and doesn’t require a typical migration. Just a few clicks and permissions. Customers can continue to use Sentinel in the Azure portal while it is available even after choosing to transition. Today, we’re announcing that we are moving to the next phase of the transition with a target to retire the Azure portal for Microsoft Sentinel by July 1, 2026. Customers not yet using the Defender portal should plan their transition accordingly. “Really amazing to see that coming, because cross querying with tables in one UI is really cool! Amazing, big step forward to the unified [Defender] portal.” Glueckkanja AG “The biggest benefit of a unified security operations solution (Microsoft Sentinel + Microsoft Defender XDR) has been the ability to combine data in Defender XDR with logs from third party security tools. Another advantage developed has been to eliminate the need to switch between Defender XDR and Microsoft Sentinel portals, now having a single pane of glass, which the team has been wanting for some years.” Robel Kidane, Group Information Security Manager, Renishaw PLC Delivering the SOC of the future Unifying threat protection, exposure management and security analytics capabilities in one pane of glass not only streamlines the user experience, but also enables Sentinel customers to realize security outcomes more efficiently: Analyst efficiency: A single portal reduces context switching, simplifies workflows, reduces training overhead, and improves team agility. Integrated insights: SOC-focused case management, threat intelligence, incident correlation, advanced hunting, exposure management, and a prioritized incident queue enriched with business and sensitivity context—enabling faster, more informed detection and response across all products. SOC optimization: Security controls that can be adjusted as threats and business priorities change to control costs and provide better coverage and utilization of data, thus maximizing ROI from the SIEM. Accelerated response: AI-driven detection and response which reduces mean time to respond (MTTR) by 30%, increases security response efficiency by 60%, and enables embedded Gen AI and agentic workflows. What’s next: Preparing for the retirement of the Sentinel Experience in the Azure Portal Microsoft is committed to supporting every single customer in making that transition over the next 12 months. Beginning July 1, 2026, Sentinel users will be automatically redirected to the Defender portal. After helping thousands of customers smoothly make the transition, we recommend that security teams begin planning their migration and change management now to ensure continuity and avoid disruption. While the technical process is very straightforward, we have found that early preparation allows time for workflow validation, training, and process alignment to take full advantage of the new capabilities and experience. Tips for a Successful Migration to Microsoft Defender 1. Leverage Microsoft’s help: Leverage Microsoft documentation, instructional videos, guidance, and in-product support to help you be successful. A good starting point is the documentation on Microsoft Learn. 2. Plan early: Engage stakeholders early including SOC and IT Security leads, MSSPs, and compliance teams to align on timing, training and organizational needs. Make sure you have an actionable timeline and agreement in the organization around when you can prioritize this transition to ensure access to the full potential of the new experience. 3. Prepare your environment: Plan and design your environment thoroughly. This includes understanding the prerequisites for onboarding Microsoft Sentinel workspaces, reviewing and deciding on access controls, and planning the architecture of your tenant and workspace. Proper planning will ensure a smooth transition and help avoid any disruptions to your security operations. 4. Leverage Advanced Threat Detection: The Defender portal offers enhanced threat detection capabilities with advanced AI and machine learning for Microsoft Sentinel. Make sure to leverage these features for faster and more accurate threat detection and response. This will help you identify and address critical threats promptly, improving your overall security posture. 5. Utilize Unified Hunting and Incident Management: Take advantage of the enhanced hunting, incident, and investigation capabilities in Microsoft Defender. This provides a comprehensive view for more efficient threat detection and response. By consolidating all security incidents, alerts, and investigations into a single unified interface, you can streamline your operations and improve efficiency. 6. Optimize Cost and Data Management The Defender portal offers cost and data optimization features, such as SOC Optimization and Summary Rules. Make sure to utilize these features to optimize your data management, reduce costs, and increase coverage and SIEM ROI. This will help you manage your security operations more effectively and efficiently. Unleash the full potential of your Security team The unified SecOps experience available in the Defender portal is designed to support the evolving needs of modern SOCs. The Defender portal is not just a new home for Microsoft Sentinel - it’s a foundation for integrated, AI-driven security operations. We’re committed to helping you make this transition smoothly and confidently. If you haven’t already joined the thousands of security organizations that have done so, now is the time to begin. Resources AI-Powered Security Operations Platform | Microsoft Security Microsoft Sentinel in the Microsoft Defender portal | Microsoft Learn Shifting your Microsoft Sentinel Environment to the Defender Portal | Microsoft Learn Microsoft Sentinel is now in Defender | YouTube
Defender XDR: Tables not supported for table management
I am trying to extend the table retention of specific tables to allow them to flow to Sentinel Analytics but keep getting the message "This table is not supported for table management" in the Sentinel > Configuration > Tables page. The Sentinel workspace is connected in System > Settings > Microsoft Sentinel. I can see the table type is XDR in the list which seems to be the reason why it can't be managed. Any ideas why this table is not able to be managed.Microsoft Ignite 2026: New Sentinel Connectors Announcement
Microsoft Sentinel helps organizations detect, investigate, and respond to threats across increasingly complex environments. As AI transforms security operations, bringing together the right data and context is more important than ever, giving human defenders and AI agents a more complete view of the environment to reason over and act on. These integrations bring signals from Microsoft and third-party technologies together across the security environment, unlocking richer context for investigations and helping power the new Integrated Security Operations Center (ISOC) in Microsoft Defender, where human defenders and AI agents can reason across the environment with shared context. The connector ecosystem isn’t the only area seeing rapid growth. Microsoft Sentinel continues to add new capabilities, including Nested API support, Azure Blob support, and multi-account support, while AI-powered tools like the connector builder agent are making it easier than ever for developers to build integrations and bring more of their security data into Sentinel. At the same time, Unified Data Management, now in public preview, makes it easier for customers to manage their Microsoft Sentinel data, connectors, tables, and ingestion health in one place. For Microsoft Ignite 2026, we’re excited to showcase recent additions to this growing ecosystem and the partners making them possible. These new and enhanced connectors continue to broaden the security data available to customers, helping human defenders and AI agents gain the context they need across the technology estate. Airlock Digital for Microsoft Sentinel Airlock Digital helps prevent malware, ransomware, and unauthorized software with deny by default application control, allowing only trusted applications, scripts, and processes to run. Its Microsoft Sentinel push integration ingests execution history, browser extension control events, server administrative activity, and policy changes for monitoring and investigation. Included parsers map execution and audit events to Microsoft’s ASIM for analysis alongside other security signals. A customizable workbook supports investigation and monitoring, and teams can create analytics rules using the ingested data. NC Protect Data Connector for Microsoft Sentinel NC Protect Data Connector for Microsoft Sentinel from archTIS brings user activity and protection logs from NC Protect into Sentinel for centralized security analysis. The connector captures user activities and access-related events, while built-in workbooks support investigation and visualization of user behavior. By correlating NC Protect audit data with other security telemetry, the integration helps teams identify suspicious user activity, trigger alerts and response workflows, strengthen auditing, and monitor guest activity across SharePoint and Teams. blacklens.io for Microsoft Sentinel blacklens.io for Microsoft Sentinel brings external and internal attack-surface data, risk-prioritized vulnerabilities, darknet intelligence, and supply-chain risks into Microsoft Sentinel. The connector ingests exposed assets, compromised identities, stolen credentials and session cookies, typosquatting domains, and supplier activity on ransomware leak sites. The solution includes a data connector and analytics rule for creating Sentinel incidents, with configurable notification rules for alert severity and type. Findings are available in Log Analytics for correlation with existing Sentinel signals and can support custom analytics rules, workbooks, automation, and threat investigations. BloodHound Enterprise BloodHound Enterprise (BHE) helps organizations protect critical assets across modern hybrid environments by continuously uncovering identity attack paths and providing actionable remediation guidance. By integrating with Microsoft Sentinel, BHE delivers attack path data and identity security posture insights directly into Sentinel workflows. This helps security teams prioritize remediation efforts based on exposure to critical assets while enriching investigations into identity-based threats, including lateral movement and privilege escalation. Together, BHE and Microsoft Sentinel help security teams connect threat detection to underlying identity risk, speed investigations, and reduce opportunities for attackers. BlueVoyant Anthropic Claude Compliance BlueVoyant Anthropic Claude Compliance brings compliance activity from the Anthropic Claude Compliance API into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector ingests Claude compliance events into Sentinel, giving security, risk, and audit teams centralized visibility into AI usage and related activity. By correlating these compliance signals with identity, endpoint, and other security telemetry, the integration supports threat hunting, investigation of policy violations and anomalous behavior, compliance monitoring, and repeatable audit workflows. Cato Networks for Microsoft Sentinel Cato Networks for Microsoft Sentinel brings security and network events from the Cato SASE Platform into Microsoft Sentinel using the Codeless Connector Framework (CCF) Push pattern. The connector pushes events into a dedicated Log Analytics table, making Cato activity available alongside other Sentinel data. By centralizing this telemetry in Sentinel, the integration enables security teams to incorporate Cato events into threat hunting, detection, and visualization workflows alongside broader security signals. Check Point EM ThreatCloud Intelligence Feed Connector for Microsoft Sentinel The Check Point EM ThreatCloud Intelligence Feed Connector brings threat intelligence from Check Point Exposure Management into Microsoft Sentinel. The connector ingests indicators of compromise (IoCs), including malicious IP addresses, domains, URLs, and file hashes, enriched with threat context such as confidence, severity, kill-chain stage, and campaign associations. An included playbook further enriches incident IoCs through ThreatCloud, helping security teams correlate intelligence with existing telemetry, accelerate triage and investigation, and reduce the manual effort required to maintain threat intelligence. Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel Check Point Exposure Management Threat Intelligence IoC for Microsoft Sentinel brings threat intelligence from Check Point Infinity External Risk Management into Sentinel. The connector ingests malicious IP addresses, domains, URLs, and file hashes, enriched with context such as severity, confidence, and detected activity. By correlating these indicators of compromise (IoCs) with existing logs through analytics rules, hunting queries, and watchlists, the integration helps security teams reduce manual intelligence management, identify matches with external threats, and accelerate threat detection and investigation. Citrix SPA Sentinel App Citrix SPA Sentinel App brings Citrix Secure Private Access and Device Posture service events into Microsoft Sentinel using the Codeless Connector Framework (CCF). The connector imports critical logs, policy outcomes, and user activity data, giving security teams greater visibility into application access and device posture activity. An included workbook supports visualization and analysis of Citrix data, helping SOC teams correlate activity with broader security telemetry, investigate security risks, support compliance monitoring, and strengthen threat hunting across their environment. ContraForce Events for Microsoft Sentinel ContraForce Events for Microsoft Sentinel brings security delivery and administrative activity from ContraForce workspaces into Microsoft Sentinel using the Codeless Connector Framework (CCF). ContraForce is an Agentic Security Delivery Platform for service providers and security teams running triage, investigation, and response across Microsoft Defender XDR and Sentinel. The connector ingests incidents, privileged access changes, service account credential activity, and high-impact workspace actions. Three included analytics rules detect privileged access, credential, and high-impact workspace activity, helping teams monitor and investigate the platform supporting their security operations. Corelight for Microsoft Sentinel By transforming all network traffic into rich, comprehensive evidence, Corelight gives security teams using Microsoft Sentinel the visibility to understand exactly what is happening across their enterprise networks. In addition to native integration with Microsoft Sentinel, Corelight integrates with Microsoft Defender for Endpoint, Defender Vulnerability Management, and Entra ID to streamline investigations, accelerate responses, and remediate incidents quickly and easily. The Corelight App for Microsoft Sentinel includes intuitive dashboards, pre-defined workbooks , sample queries, and analytics rules that help make SOC teams more efficient and effective. CTM360 CTM360 brings external threat visibility into Microsoft Sentinel. The integration connects the CTM360 HackerView and CyberBlindspot platforms to Sentinel through REST APIs, so external attack surface and digital risk events flow straight into security operations workflows. HackerView surfaces externally exposed assets and security issues across your attack surface. CyberBlindspot adds organization-specific threat intelligence from surface, deep, and dark web monitoring. With these signals centralized in Sentinel, security teams can analyze external exposures alongside their broader telemetry and speed up detection, investigation, and response. Cyren CrowdStrike IOC Automation Cyren CrowdStrike IOC Automation connects Cyren IP reputation threat intelligence with Microsoft Sentinel and CrowdStrike Falcon to operationalize malicious IP indicators. An included Logic App playbook automatically retrieves known malicious IP addresses from Cyren and submits them to CrowdStrike Falcon as custom indicators of compromise (IOCs) for blocking and detection. Scheduled execution keeps the intelligence updated and automates the flow of Cyren IP reputation data into CrowdStrike Falcon for blocking and detection. Vaikora AI Agent Signals for Microsoft Sentinel Vaikora AI Agent Signals for Microsoft Sentinel brings behavioral security signals from AI agents into Sentinel for centralized monitoring and response. The connector ingests risk scores, anomaly and threat classifications, policy enforcement decisions, and audit data, including signals for prompt injection attempts and suspicious tool usage. Included analytics rules and a workbook help security teams detect behavioral anomalies, investigate policy violations, and incorporate AI agent risks into existing Sentinel incident workflows. Vaikora AI Agent Signals for SentinelOne Vaikora AI Agent Signals for SentinelOne brings high-risk behavioral security signals from Vaikora into SentinelOne as threat intelligence indicators of compromise (IOCs). The integration filters high-severity and anomalous AI agent activity and maps Vaikora risk scores to SentinelOne severity levels. The resulting IOCs are submitted to SentinelOne and expire after 90 days, enabling Vaikora security signals to be incorporated into SentinelOne endpoint protection workflows. DataBahn Agentic Data Control Plane for Microsoft Sentinel DataBahn’s agentic data control plane integrates with Microsoft Sentinel to provide our shared customers an AI-native data pipeline and orchestration platform that allows them to accelerate enterprise deployments. DataBahn’s pipeline standardizes onboarding and shaping across all data sources while providing operational visibility into data flow and health. Together, the collaboration focuses on reducing onboarding friction, improving normalization consistency, and enabling intentional routing, which helps security teams improve visibility, support threat detection, and streamline investigation and incident response workflows. Delinea Platform for Microsoft Sentinel Delinea Platform Sentinel Solution brings privileged access activity into Sentinel natively through the Content Hub, as a complete SOC package. The connector pulls audit events covering secrets access, authentication, session activity and configuration changes directly into Sentinel. Ready-made workbooks, analytics rules with baseline-driven detection, hunting queries and an automated response playbook let security teams detect bulk secret access, failed sign-in bursts and privilege escalation sooner, investigate without leaving Sentinel and answer auditors with a record of what happened and why it was allowed. Dynatrace Software Intelligence Platform with Microsoft Sentinel Dynatrace integrates bidirectionally with Microsoft Sentinel, bringing application attacks, runtime vulnerabilities, Dynatrace Intelligence problems, and audit logs into Sentinel, where analytics rules, workbooks, and playbooks support detection, triage, and response. Sentinel can also send alerts to Dynatrace and enrich detected attacks with Sentinel and Microsoft Defender XDR insights. Bindplane by Dynatrace complements the integration by collecting and routing logs into Sentinel, including normalization to ASIM tables, giving SOC teams runtime and topology context for investigations. ExtraHop RevealX for Microsoft Sentinel ExtraHop RevealX for Microsoft Sentinel brings network detection and response (NDR) into Sentinel, giving your SOC visibility into threats that endpoint and log tools miss, including lateral movement and credential abuse hiding in encrypted east-west traffic. RevealX decrypts and analyzes network traffic at line rate, out of band with no impact on the network. The connector sends ExtraHop detections into Sentinel for dashboards, custom alerts, and investigation, so network context enriches your existing SOC workflows instead of sitting in a separate console. Fire Compass FireCompass Risks for Microsoft Sentinel brings validated external risk findings from the FireCompass platform into Microsoft Sentinel through the Codeless Connector Framework. The connector ingests risk data including severity, affected assets, assessment context, impact, and remediation guidance. By making validated exposures available in Sentinel, security teams can correlate external risks with endpoint and network telemetry, track remediation progress, and build analytics rules, workbooks, and hunting queries on top of FireCompass findings. Gambit Security Sentinel Solution Gambit brings resilience context into Microsoft Sentinel. It finds the resilience issues in your environment and syncs them to your Sentinel workspace daily, to help analysts see recovery risk before anything goes wrong. Sentinel correlates those issues with its detections. Your team can then prioritize the attacks most likely to disrupt critical operations: the ones hitting resources that aren’t ready to recover. Sentinel tells you what’s happening. Gambit tells you whether you can recover from it. Holm Security for Microsoft Sentinel Holm Security for Microsoft Sentinel brings asset data from the Holm Security platform into Sentinel via the Holm Security REST API. The connector ingests web and network assets into Microsoft Sentinel, including metadata such as IP addresses, hostnames, operating systems, tags, and vulnerability counts per asset. By incorporating this asset inventory alongside other security telemetry, the integration enables security teams to build dashboards, create custom alerts, and correlate asset information with other data in Microsoft Sentinel. Idira Endpoint Privilege Manager for Microsoft Sentinel The Idira® Endpoint Privilege Manager by Palo Alto Networks integration for Microsoft Sentinel pulls application events and policy audit activity into Microsoft Sentinel using the Codeless Connector Framework and the Idira Endpoint Privilege Manager REST API. Events land in a dedicated Log Analytics table, so security teams can analyze privilege activity alongside their other telemetry and build detections. IPinfo: IP geolocation & intelligence database IPinfo: IP geolocation & intelligence database brings contextual IP intelligence into Microsoft Sentinel to enrich security logs and investigations. The solution provides data such as IP geolocation, network ownership and routing, proxy and residential proxy detection, ASN information, and other IP classifications. By adding this context to IP addresses observed in Sentinel, the integration helps security teams better understand indicators of compromise, prioritize security events, strengthen threat detection and investigation, and inform network and access management decisions. Island Solution for Microsoft Sentinel Island Solution for Microsoft Sentinel brings user activity and administrative audit events from the Island Enterprise Browser into Microsoft Sentinel for centralized security monitoring. The solution automatically shares events from the Island Management Console with Sentinel and includes data connectors and workbooks for user activity and admin audit logs. By adding browser activity context to existing security telemetry, the integration helps security teams monitor and analyze user and administrative activity and investigate potential security issues. NetApp Ransomware Resilience for Microsoft Sentinel NetApp Ransomware Resilience detects and contains ransomware attacks on NetApp ONTAP workloads in real time, then enables fast, clean recovery. Its Microsoft Sentinel integration enriches alerts with data-layer context, including attack type, severity, user and IP, and affected cluster, volume, and SVM. The NetApp SOAR playbook can take actions on ONTAP such as trigger immutable snapshots, block suspicious users or IPs, and take compromised volumes offline. Together, these integrations extend the NetApp Platform’s ability to help security teams triage and respond to ransomware attacks, limit data loss, protect recovery points, and coordinate response across storage and security teams. NordStellar for Microsoft Sentinel NordLayer Intelligence by NordStellar for Microsoft Sentinel brings external threat and exposure findings into Sentinel through the Azure Monitor Logs Ingestion API. The integration provides findings including leaked credentials, breach exposures, malware and info-stealer infections, dark web activity, domain impersonation risks, and external attack surface vulnerabilities. By correlating these findings with other security telemetry in Sentinel, the solution helps teams investigate external threats, identify exposures affecting their organization, and automate triage and response through analytics rules and SOAR playbooks. Panorays for Microsoft Sentinel Panorays for Microsoft Sentinel brings third-party security findings from the Panorays platform into Sentinel through the Panorays API. The connector provides security teams with visibility into the security posture of vendors and supply-chain organizations, making third-party risk and vulnerability findings available alongside other security telemetry. By incorporating Panorays findings into Sentinel workflows, the integration helps SOC teams centrally monitor and investigate third-party risks and correlate them with internal security signals. USTA Account Takeover Prevention Sentinel Connector USTA Account Takeover Prevention Sentinel Connector brings compromised credential intelligence from the PRODAFT USTA Threat Intelligence platform into Microsoft Sentinel. The connector ingests alerts for exposed corporate credentials, enabling security teams to investigate potential account takeover risks within existing Sentinel workflows. Included analytics can identify newly compromised credentials and successful Microsoft Entra ID sign-ins involving known-compromised accounts, helping SOC teams operationalize external credential intelligence and prioritize investigation and response. USTA IoC Threat Stream for Sentinel USTA IoC Threat Stream for Sentinel brings curated indicators of compromise (IoCs) from the PRODAFT USTA Threat Stream into Microsoft Sentinel Threat Intelligence. The integration provides indicators including malicious URLs, phishing sites, and malware hashes derived from PRODAFT investigations. By making these indicators available for correlation with existing telemetry, hunting queries, and detection rules, the solution helps security teams identify connections to malicious infrastructure, investigate phishing and malware activity, and incorporate external threat intelligence into existing triage and response workflows. USTA Payment Card Fraud Intelligence Sentinel Connector USTA Payment Card Fraud Intelligence Sentinel Connector brings compromised payment card intelligence from the PRODAFT USTA Threat Intelligence platform into Microsoft Sentinel. The connector retrieves alerts associated with an organization’s payment card BIN ranges and makes them available within Sentinel for investigation. Included analytics identify newly exposed and non-expired compromised cards, helping security teams centralize payment fraud intelligence, prioritize potentially actionable exposures, and incorporate them into existing investigation and response workflows. Pulumi Cloud Audit Logs for Microsoft Sentinel Pulumi Cloud Audit Logs for Microsoft Sentinel brings audit logs from Pulumi, the infrastructure platform for humans and agents, into Microsoft Sentinel through the Codeless Connector Framework (CCF). The connector ingests authentication events, organization membership changes, stack lifecycle operations, policy changes, and access token usage. It also includes three analytics rules that detect failed login attempts, stack deletions, and organization membership changes. Your security team can see what a human or agent did, when, and where across infrastructure as code, secrets, configuration, and policies, which helps speed up security and governance investigations. QCrypton PQC Scanner for Microsoft Sentinel QCrypton PQC Scanner for Microsoft Sentinel brings post-quantum cryptography readiness findings from Azure environments into Sentinel using the Codeless Connector Framework (CCF). The connector provides visibility into cryptographic assets including Key Vault keys, TLS certificates and configurations, and Entra ID app registration certificates, with quantum posture ratings and risk scores. Included are six analytics rules, a workbook, and a notification playbook to help security teams identify vulnerable cryptographic assets and prioritize post-quantum migration planning. SailPoint for Microsoft Sentinel SailPoint for Microsoft Sentinel brings identity security telemetry from SailPoint Identity Security Cloud into Sentinel using the Codeless Connector Framework (CCF). The solution streams audit and search events into Sentinel tables, where analysts can correlate identity activity with other security signals and query SailPoint APIs for additional identity and account context during incident triage. Automated playbooks can also remediate threats by revoking access or disabling compromised accounts, helping teams connect identity insight with investigation and response. SAP LogServ (RISE), S/4HANA Cloud private edition SAP LogServ (RISE), S/4HANA Cloud private edition extends Microsoft Sentinel security monitoring for SAP RISE environments with infrastructure, database, operating system, and network security logs managed by SAP Enterprise Cloud Services. Deployed alongside the Microsoft Sentinel Solution for SAP applications, it complements application-layer monitoring to provide visibility across the SAP stack and enable cross-layer threat detection and correlation. The solution supports near real-time log collection, built-in analytics and workbooks, ASIM-based security content, and correlation with signals from endpoints, Microsoft Entra ID, and other sources in Microsoft Sentinel. MailRisk data connector for Microsoft Sentinel MailRisk data connector for Microsoft Sentinel brings suspicious email data analyzed by users through Secure Practice MailRisk into Sentinel. The connector ingests enriched email metadata and risk assessment updates from the Secure Practice API, providing potential indicators of compromise identified from reported emails. By incorporating MailRisk data alongside other security telemetry, the integration helps security teams correlate suspicious email activity, search and investigate potential threats, and incorporate user-reported email intelligence into alerting and incident response workflows. SecurityScorecard Ratings for Microsoft Sentinel SecurityScorecard Ratings for Microsoft Sentinel provides cybersecurity posture ratings based on continuously monitored risk factors and threat intelligence. SecurityScorecard evaluates organizations using an A-F rating, helping security teams identify and track cybersecurity risks. The solution supports use cases including enterprise cyber risk management, third-party risk monitoring, executive reporting, and cyber due diligence. SIGNL4 - Mobile Alerting & Response for Microsoft Sentinel and Defender for Cloud SIGNL4 bridges the gap between security detection and human response with mobile-first alerting and incident management for Microsoft Sentinel and Defender for Cloud. Its two-way integrations allow security teams to acknowledge, escalate, and resolve incidents directly from their mobile devices, with updates automatically synchronized back to Sentinel. Critical Defender for Cloud findings trigger actionable response workflows, while persistent mobile notifications, automated escalations, and on-call scheduling ensure the right people are reached when it matters most. The result is faster incident response, clear accountability, and a fully auditable process - wherever responders are. SOC Prime Audit CCP SOC Prime Audit CCP brings SOC Prime Platform audit logs into Microsoft Sentinel for centralized security monitoring and analysis. The connector ingests platform activity including user actions, API calls, and administrative events, providing an audit trail across detection engineering processes. By correlating SOC Prime activity with other security signals in Sentinel, the integration helps security teams investigate platform activity, support compliance monitoring, and incorporate audit telemetry into broader threat detection and response workflows. SOCRadar Alerts Azure Sentinel Directional Solution SOCRadar Threat Intelligence for Microsoft Sentinel enriches security operations by bringing prioritized, context-rich alerts directly into Microsoft Sentinel. Covering SOCRadar’s Extended Threat Intelligence capabilities, including Brand Protection, External Attack Surface Management (ASM), Third-Party Findings, and other security modules, the integration helps organizations monitor external threats and manage investigations within their existing SOC workflows. Bidirectional synchronization also helps keep incident status, severity, and comments aligned between Microsoft Sentinel and SOCRadar. SpyCloud Enterprise Protection for Microsoft Sentinel SpyCloud Enterprise Protection for Microsoft Sentinel brings stolen identity data from infostealer malware, phishing attacks, and third-party breaches into Microsoft Sentinel, helping security teams uncover compromised identities, prioritize high-risk exposures, and accelerate remediation to prevent session hijacking and other targeted identity-based attacks. The solution includes a custom API connector, a Logic Apps playbook for ingesting data into Log Analytics, analytic rules that generate Sentinel incidents from breach and malware data, and additional Logic Apps playbooks for incident automation and enrichment. Tenable App for Microsoft Sentinel Tenable App for Microsoft Sentinel brings asset and vulnerability data from Tenable One Vulnerability Management into Sentinel for centralized security analysis. The integration combines Tenable cyber exposure insights with Sentinel’s collection, detection, and investigation capabilities, making vulnerability context available alongside other security telemetry. By incorporating asset and vulnerability findings into Sentinel workflows, the solution helps security teams correlate exposure data with security signals, investigate risks affecting vulnerable assets, and better prioritize remediation efforts. Uniqkey Security Events for Microsoft Sentinel Uniqkey Security Events for Microsoft Sentinel brings authentication, credential access and management, sharing, administrative activity, and platform threat detections into Microsoft Sentinel using the Codeless Connector Framework (CCF). Included analytics rules identify scenarios such as sign-ins from unfamiliar IP addresses, excessive credential access, data exports, and security policy or privilege changes. A workbook visualizes activity and threat detections, helping security teams monitor password-management activity, investigate potential credential risks, and correlate findings with broader security telemetry. Utimaco Enterprise Secure Key Manager Utimaco Enterprise Secure Key Manager (ESKM) integrates with Microsoft Sentinel to provide centralized security monitoring and visibility into cryptographic key management activities through KMIP server logs. The solution enables organizations to monitor key operations, KMIP client activity, and authentication events, helping security teams identify suspicious behavior and investigate potential threats. Built-in analytics rules help detect brute-force authentication attempts, repeated permission-denied events, and key-destruction activity, while hunting queries and a dedicated workbook support deeper investigation of unusual users, source IPs, key retrieval patterns, and after-hours activity. valimail-sentinel-enforce Valimail enables organizations to see who sends email using your domain, protects against domain impersonation, and displays a verified logo in inboxes to increase brand trust. Our Microsoft Sentinel Connector brings Valimail Enforce event data directly into Sentinel, allowing security teams to incorporate our telemetry into unified SIEM workflows, monitor authentication and enforcement trends in real time, and build custom alerts and visualizations based on DMARC events. Once configured, Sentinel continuously ingests Valimail event logs, enriching your broader security intelligence and helping to improve your ability to detect and respond to threats across your environment. Varonis for Sentinel Solutions Varonis for Sentinel Solutions brings enriched, data-centric Varonis alerts into Microsoft Sentinel for triage, investigation, and remediation. Varonis insights are contextualized alongside other security events to provide a unified view of data risk. This allows security teams to view and close Varonis alerts directly within Sentinel, reducing the need to switch interfaces and supporting incident resolution with less manual effort Whisper for Sentinel Whisper for Sentinel enriches Microsoft Sentinel incidents and alerts with threat and infrastructure intelligence for IPs, domains, ASNs, and networks. The solution provides threat scores, supporting evidence, infrastructure relationships, and historical context directly within Sentinel. Included enrichment playbooks, analytics rules, hunting queries, and workbooks support investigation of threats including C2 communications, malicious infrastructure, suspicious domains, and BGP anomalies, while retained enrichment data can be queried and correlated with existing logs. WhoisFreaks Threat Intelligence for Microsoft Sentinel The WhoisFreaks solution for Microsoft Sentinel brings domain threat intelligence and newly registered domain (NRD) data into Sentinel using the Codeless Connector Framework (CCF). Customers can connect malware, phishing, and spam threat feeds, along with gTLD and ccTLD NRD feeds with or without WHOIS data. Included analytics rule templates help identify high-confidence malicious domains, newly registered domains appearing in threat feeds, threat-listed parked domains, and unusual NRD volumes that may indicate bulk registration activity. Wiz for Microsoft Sentinel Wiz for Microsoft Sentinel brings Wiz Issues, Vulnerability Findings, and Audit logs into Microsoft Sentinel. Wiz identifies and prioritizes cloud security risks across areas including vulnerabilities, malware, internet exposure, identity, and data security in AWS, Azure, Google Cloud, OCI, Alibaba, and Kubernetes environments. In addition to the solutions from our third-party partners, we are also excited to announce the following connectors published by the Microsoft Sentinel team: Agari Solution Akamai DDOS Protection Alibaba Cloud Networking Atlassian Organization Audit AWS Elastic Kubernetes Service AWS Elastic Load Balancing Cisco Cloud Security Cisco Meraki Events via REST API Crowdstrike Falcon Endpoint Protection Elastic Agent Solution Imperva WAF Cloud Solution Microsoft Copilot Microsoft Dragon Copilot Mulesoft CloudHub Alerts OpenAI Qualys VM Knowledgebase Rapid7 InsightVM CloudAPI SentinelOne TheHive Solution Trellix Enpoint Security Trend Micro Cloud App Security VMware Workspace ONE Zoom Reports Building a more connected foundation for security operations The strength of the connector ecosystem reflects the work of Microsoft and our technology partners to support our shared customers. Together, we are helping organizations connect the technologies they rely on and bring more of their security data into a unified operational experience. For customers If you are a Microsoft Sentinel or ISOC customer, or considering adopting it, we want you to have the security connectors and integrations you need to get value from the platform. If an integration with an independent software vendor (ISV) is not yet available, or you have an issue with an existing solution, we have a dedicated team that may be able to assist by working with ISVs to build new or update existing connectors. For software companies If you are a software development partner, the Microsoft Sentinel Codeless Connector Framework (CCF) provides a streamlined way to bring your product into the Microsoft Security ecosystem. Partners can also work directly with Microsoft for engineering guidance and support to build or improve a connector. Building a more connected foundation for security operations Our goal is simple: help customers protect their digital environments by giving human defenders and AI agents a more complete picture of risk. We’ll continue investing in connectors, partnerships, and integrated security experiences to help customers defend their organizations with greater visibility, context, and confidence. Learn More Microsoft Sentinel What is Microsoft Sentinel Empower Real-Time Security with Microsoft Sentinel’s CCF Push Feature | Microsoft Community Hub Growing our connector ecosystem with 500+ Microsoft Sentinel connectors Microsoft Defender ISOC in Microsoft Defender Microsoft Sentinel connector hands-on labs Building Microsoft Sentinel Connectors in Minutes with the Sentinel Connector Builder Agent Building a CCF Nested API Pull Connector: A Technical Lab Walkthrough Microsoft Sentinel features in public preview Accelerate connectors development using AI agent in Microsoft Sentinel | Microsoft Community Hub Extending Sentinel Data Integration: Azure Blob Storage Support for CCF Connectors | Microsoft Community Hub Public Preview: Nested API Support Comes to Microsoft Sentinel CCF | Microsoft Community Hub Public Preview: Multi-Account Support for Microsoft Sentinel Codeless Connectors | Microsoft Community Hub Manage all your Microsoft Sentinel data in one place with Unified Data Management (Public Preview) | Microsoft Community HubThe CISO Cheat Sheet to Microsoft Digital Defense Report 2026
I know we’re all busy, so I’ve pulled the most important data from this year’s Microsoft Digital Defense Report into one short read. The full report is well worth exploring, but this article focuses on the numbers and trends most relevant to security leaders. This year’s edition shows that AI is lowering the time, expertise and cost required to discover and exploit weaknesses, enabling attackers to operate with greater speed, scale and autonomy. The report describes this as AI “changing the physics of cybersecurity”: attack timelines are compressing and agentic systems are beginning to automate more of the attack lifecycle. Trend 1: Time has collapsed The clearest finding is about speed. Vulnerability discovery is increasingly running ahead of remediation, while the time from discovery to weaponisation is shrinking. In the AI era, weaponisation can follow in hours. Vulnerability discovery and weaponisation now often needs only a well-written prompt. The median time from discovery in the wild to weaponisation is below 24 hours. Vulnerabilities were on track for a record estimated 72,000 CVEs in 2026. The report expects a multi-year period in which the number of known but unpatched vulnerabilities rises sharply before eventually declining. The median time from container start to first exploit attempt is 5.3 hours. The ransomware actor Storm-1175 moved from web-facing exploitation to deploying Medusa ransomware in as little as 24 hours. CISA added over 110 CVEs to its Known Exploited Vulnerabilities catalogue between November 2025 and May 2026, most within a week of disclosure. The mismatch with enterprise reality is the uncomfortable part. The report says the disclosure-to-exploitation window has shrunk to single-digit days. Between November 2025 and May 2026, CISA added more than 110 vulnerabilities to its Known Exploited Vulnerabilities catalogue, most within a week of disclosure. In one example, Storm-1175 moved from exploiting a web-facing vulnerability to deploying Medusa ransomware in as little as 24 hours. Microsoft’s Red Team makes an important point: a patch is also a disclosure. Every fix points attackers towards the flaw it closes. As AI-assisted analysis makes reversing patches faster and more reliable, the report argues that patch velocity, not simply patch availability, becomes the control that matters. Trend 2: Attack chains are gaining autonomy The report charts a clear progression: September–November 2025: AI assists in orchestrating a campaign, as in the Anthropic-reported espionage case. April–June 2026: Full-chain autonomy is demonstrated in labs. July 2026: Real-world autonomous attacks of increasing complexity appear. Two frontier models, Mythos and GPT-5.5, completed a 32-step attack chain against an emulated enterprise with no human help. The test environment had no defenders. The UK AI Security Institute reached a similar finding independently. GPT-5.5 was the second model to solve its end-to-end corporate network attack simulation, a task AISI estimates would take a human about 20 hours. Open-weight models lag closed models at orchestrating attacks by about seven months. In the wild, early July 2026 saw the first documented automated ransomware extortion attack, named JADEPUFFER by Sysdig. Microsoft has seen AI-orchestrated intrusions that share elements with it. Initial access consistently came from internet-exposed services running known-vulnerable software. The report is measured on this point. Volumes of AI-orchestrated activity remain low. In most observed real-world operations, complex end-to-end intrusions still retain meaningful human direction. The Red Team's framing is the most useful one: AI doesn't create a new class of attack, it collapses the effort needed to find and exploit existing attack paths. Trend 3: AI has become an attack surface The report's second takeaway is that attackers are already targeting AI itself. The adoption numbers explain why. 88% of enterprises are experimenting with agents, and 82% of leaders plan broader rollouts within 12–18 months. The report cites industry projections of roughly 1.3 billion agents in production by 2028. What attackers are doing to AI systems: Four techniques accounted for roughly 90% of observed attack activity in telemetry from Azure AI workloads: malicious link injection (52%), jailbreaks (16%), tool and agent abuse (12%), and identity and credential abuse (10%). Memory poisoning: An attacker who can place content anywhere an agent reads can often place it where the agent remembers. Email is the dominant pathway the Red Team has observed. Human-in-the-loop isn't a complete control: Red team testing saw approval prompts ignored, or bypassed by a policy stored in poisoned memory. Developer tools turned against their owners: The "s1ngularity" malware hijacked locally installed AI command-line tools to hunt for secrets. It leaked about 2,000 secrets and 20,000 files across 225 victims. AI browsers: In daily use at more than 40% of organisations in Microsoft's dataset, they were the initial infection vector in incidents involving 57 malware families in a May 2026 analysis. Chat histories as a target: Malicious AI-assistant extensions reached nearly 900,000 installs and more than 20,000 enterprise tenants, harvesting AI chat histories that often contain code, architecture and credentials. The identity implications are direct. Each agent needs its own identity, not one borrowed from an employee, and a named human sponsor. The report also treats revocation latency, the time to cut off a compromised agent, as a measured outcome. Trend 4: The front door is still identity AI changes the speed and personalisation of social engineering. It hasn't changed where attacks start. Initial access in Defender Experts data: User execution: 30% Valid accounts: 20% Malicious copy-and-paste: 13% Phishing: 11% Together, user execution and valid accounts account for over half of observed activity. In incident response engagements, phishing as an initial access vector jumped from 7% to 23% year on year. The standout numbers: ClickFix: Defender saw user-pasted malicious commands on more than 1.1 million unique devices between February and early May 2026, roughly an 8x increase. AiTM: URLs accounted for 45% of the identified phishing techniques in the report’s breakdown. Separately, the share of AiTM phishing and token-theft attacks more than doubled during the first six months of 2026, although the report notes that their overall share remained comparatively small. Teams vishing: Weekly confirmed malicious volume increased 502% year on year. Per attempt, 48% of vishing calls kept the victim engaged for more than 20 seconds, and 30% lasted more than one minute. When a call succeeds, attackers can persuade the victim to install a remote-management tool and complete reconnaissance in two minutes or less. Business contact impersonation (BCI): The report introduces this term for conversations that start with a trusted-looking contact. Microsoft detected more than 46 million attacks in 12 months, with a 121% spike in April 2026. The share of first-contact messages that explicitly asked for money or documents fell from 17% to 3%. The first message is deliberately bland, like "Are you at your desk?" Password attacks declined 26% year on year, which the report describes as strong evidence that MFA and passkeys are forcing attackers to pivot. That pivot includes techniques such as fatigue attacks, AiTM phishing and token theft designed to circumvent conventional MFA. Trend 5: Attackers are inheriting trust rather than breaking in The report's headline theme is that risk is increasingly interconnected. Threats travel through the trusted relationships between identities, software supply chains, partners and cloud platforms. The numbers: Supply chain: Major open-source ecosystems saw attacks roughly every ten days, accelerating through Q2 2026. Shai-Hulud 2.0 affected 25,000 repositories. Megalodon backdoored 5,561 GitHub repositories in under six hours. Trusted signing: In May 2026, Microsoft disrupted Fox Tempest, a "malware-signing-as-a-service" operation that obtained genuine certificates for ransomware loaders and infostealers. Microsoft revoked over a thousand fraudulent code-signing certificates. Legitimate access: An unsanctioned remote monitoring tool is now one of the most reliable mid-stage indicators of a human-operated intrusion. Cloud identity: Cloud identity abuse was the most observed technique against critical infrastructure, representing 78% of the technique mix in Microsoft’s data for March to June 2026. Hybrid intrusions: The Storm-2885 case showed an attacker using a privileged cloud identity to close and downgrade security alerts. The report says identity governance and alert-handling workflows deserve Tier 0 treatment. Dwell time: DART data shows a statistically significant increase in dwell time year on year, meaning organisations took longer to detect intrusions. Ransomware shows the same ecosystem pattern. Qilin led leak-site data with 16.4% of victims, up 386%. Defender detections tell a different story, with Akira at 22%. Trend 6: Defence works best when it's connected The report is not only a catalogue of threats. The strongest defensive evidence: Disruption works. Following the March 2026 disruption, Tycoon2FA activity had fallen 95% from its November 2025 peak by June. Its share of CAPTCHA-gated phishing declined from 76% in December 2025 to 12% in June 2026. Correlation is the highest-leverage variable. The report argues that how well defenders share and correlate signals across endpoint, identity, cloud, email and network is one of the highest-leverage strategic variables under their control. AI is also changing defensive operations. The report describes AI-assisted triage, incident summarisation, hunting-query generation and detection engineering as ways to accelerate investigations and allow analysts to concentrate on higher-value work. Automated disruption can compress response time. The report says that when a correlated incident reaches a defined confidence threshold, defensive systems can automatically isolate devices, disable compromised accounts, revoke sessions or quarantine affected cloud resources. It also stresses the importance of appropriate governance and human oversight for high-risk AI actions. The report also recommends changing what leaders measure. It suggests moving from patches deployed to exposure reduced, detection coverage increased and time-to-mitigate compressed. What the MDDR recommends: ten security priorities The report starts its recommendations with the foundations: Secure by Design, Secure by Default and Secure Operations, applied through identity-centric Zero Trust. Microsoft says these keep the priorities below durable as AI adds more identities, applications, agents and dependencies to govern. Govern cyber risk at leadership level. Report identity exposure, patch latency, agent permissions, critical dependencies, dwell time and recovery readiness to the board. Defend identity as the primary control plane. Deploy passkeys and phishing-resistant MFA, reduce privilege and govern human and non-human identities. Invalidate and rotate tokens and session credentials quickly. Establish governance, visibility and data controls for AI. Keep visibility of approved AI tools, services and agents, and monitor for unauthorised or unmanaged use. Apply sensitivity-aware access and data protection to the data those systems can reach. Reduce exposure and edge risk. Continuously discover internet-facing assets and patch edge devices quickly. Centralise high-fidelity logging, enforce strong authentication and combine network visibility with threat intelligence. Focus on cross-signal correlation. Correlate endpoint, identity, cloud, application, email and network signals to detect intrusions earlier. Correlation also helps defenders anticipate attack paths and likely targets. Enact a continuous threat and vulnerability management model. Combine asset visibility, vulnerability identification, threat detection and AI-accelerated insight into a single continuous programme. Validate exposure through proactive testing. Run assume-breach exercises on cloud services, SaaS platforms, APIs and workflow automation. Prioritise them by where your highest-value data is stored, accessed or aggregated. Secure software dependencies. Harden software installation, keep a software inventory and validate provenance. Monitor packages and prepare for rapid containment. Participate in collective defence. Share actionable threat indicators and victim-informed intelligence with trusted partners and law enforcement. This supports coordinated tracking, investigation and disruption. Prepare for long-horizon technology transitions. Build a cryptographic inventory and advance post-quantum planning alongside AI governance. Read together, the numbers tell one story: the attacker’s workflow is becoming faster and less expensive. AI can shorten vulnerability discovery, exploitation, secret discovery and lateral movement, while organisations still face the slower operational work of testing, coordinating and deploying safe changes across complex environments. At the same time, agent identities can proliferate faster than organisations can inventory, govern and revoke them The defining question for boards today is not whether disruption will occur, but whether the organization can continue operating, contain harm, recover quickly, and maintain trust when it does. Source: Microsoft Digital Defense Report 2026, Version 1.1. Reporting period: July 2025–June 2026.
Microsoft Sentinel - switching simple mode to kql mode in sentinel logs
In sentinel, when i go to the alert page and from there i opened the corresponding the events using Link to LA clickable link, it opens the events in simple mode. However i have configured the Logs to open it in KQL mode and every time i have to changed it to KQL mode to do the taskRSAC 2026: New Microsoft Sentinel Connectors Announcement
Microsoft Sentinel helps organizations detect, investigate, and respond to security threats across increasingly complex environments. With the rollout of the Microsoft Sentinel data lake in the fall, and the App Assure-backed Sentinel promise that supports it, customers now have access to long-term, cost-effective storage for security telemetry, creating a solid foundation for emerging Agentic AI experiences. Since our last announcement at Ignite 2025, the Microsoft Sentinel connector ecosystem has expanded rapidly, reflecting continued investment from software development partners building for our shared customers. These connectors bring diverse security signals together, enabling correlation at scale and delivering richer investigation context across the Sentinel platform. Below is a snapshot of Microsoft Sentinel connectors newly available or recently enhanced since our last announcement, highlighting the breadth of partner solutions contributing data into, and extending the value of, the Microsoft Sentinel ecosystem. New and notable integrations Acronis Cyber Protect Cloud Acronis Cyber Protect Cloud integrates with Microsoft Sentinel to bring data protection and security telemetry into a centralized SOC view. The connector streams alerts, events, and activity data - spanning backup, endpoint protection, and workload security - into Microsoft Sentinel for correlation with other signals. This integration helps security teams investigate ransomware and data-centric threats more effectively, leverage built-in hunting queries and detection rules, and improve visibility across managed environments without adding operational complexity. Anvilogic Anvilogic integrates with Microsoft Sentinel to help security teams operationalize detection engineering at scale. The connector streams Anvilogic alerts into Microsoft Sentinel, giving SOC analysts centralized visibility into high-fidelity detections and faster context for investigation and triage. By unifying detection workflows, reducing alert noise, and improving prioritization, this integration supports more efficient threat detection and response while helping teams extend coverage across evolving attack techniques. BigID BigID integrates with Microsoft Sentinel to extend data security posture management (DSPM) insights into security operations workflows. The solution brings visibility into sensitive, regulated, and critical data across cloud, SaaS, and on‑premises environments, helping security teams understand where high‑risk data resides and how it may be exposed. By incorporating data‑centric risk context into Sentinel, this integration supports more informed investigation and prioritization, enabling organizations to reduce data‑related risk and align security operations with data protection and compliance objectives. Commvault Cloud Commvault Cloud integrates with Microsoft Sentinel to bring data protection and cyber‑resilience telemetry into security operations workflows. The connector ingests security‑relevant signals from Commvault Cloud—such as backup anomalies, malware and ransomware indicators, and other threat‑related events—into Sentinel, enabling centralized detection, investigation, and automated response. By correlating backup intelligence with broader Sentinel telemetry, this integration helps security teams reduce blind spots, validate the scope of incidents, and improve coordination between security and recovery operations. CyberArk Audit CyberArk Audit integrates with Microsoft Sentinel to centralize visibility into privileged identity and access activity. By streaming detailed audit logs - covering system events, user actions, and administrative activity - into Microsoft Sentinel, security teams can correlate identity-driven risks with broader security telemetry. This integration supports faster investigations, improved monitoring of privileged access, and more effective incident response through automated workflows and enriched context for SOC analysts. Cyera Cyera integrates with Microsoft Sentinel to extend AI-native data security posture management into security operations. The connector brings Cyera’s data context and actionable intelligence across multi-cloud, on-premises, and SaaS environments into Microsoft Sentinel, helping teams understand where sensitive data resides and how it is accessed, exposed, and used. Built on Sentinel’s modern framework, the integration feeds context-rich data risk signals into the Sentinel data lake, enabling more informed threat hunting, automation, and decision-making around data, user, and AI-related risk. TacitRed CrowdStrike IOC Automation Data443 TacitRed CS IOC Automation integrates with Microsoft Sentinel to streamline the operationalization of compromised credential intelligence. The solution uses Sentinel playbooks to automatically push TacitRed indicators of compromise into CrowdStrike via Sentinel playbooks, helping security teams turn identity-based threat intelligence into action. By automating IOC handling and reducing manual effort, this integration supports faster response to credential exposure and strengthens protection against account-driven attacks across the environment. TacitRed SentinelOne IOC Automation Data443 TacitRed SentinelOne IOC Automation integrates with Microsoft Sentinel to help operationalize identity-focused threat intelligence at the endpoint layer. The solution uses Sentinel playbooks to automatically consume TacitRed indicators and push curated indicators into SentinelOne via Sentinel playbooks and API-based enforcement, enabling faster enforcement of high-risk IOCs without manual handling. By automating the flow of compromised credential intelligence from Sentinel into EDR, this integration supports quicker response to identity-driven attacks and improves coordination between threat intelligence and endpoint protection workflows. TacitRed Threat Intelligence Data443 TacitRed Threat Intelligence integrates with Microsoft Sentinel to provide enhanced visibility into identity-based risks, including compromised credentials and high-risk user exposure. The solution ingests curated TacitRed intelligence directly into Sentinel, enriching incidents with context that helps SOC teams identify credential-driven threats earlier in the attack lifecycle. With built-in analytics, workbooks, and hunting queries, this integration supports proactive identity threat detection, faster triage, and more informed response across the SOC. Cyren Threat Intelligence Cyren Threat Intelligence integrates with Microsoft Sentinel to enhance detection of network-based threats using curated IP reputation and malware URL intelligence. The connector ingests Cyren threat feeds into Sentinel using the Codeless Connector Framework (CCF), transforming raw indicators into actionable insights, dashboards, and enriched investigations. By adding context to suspicious traffic and phishing infrastructure, this integration helps SOC teams improve alert accuracy, accelerate triage, and make more confident response decisions across their environments. TacitRed Defender Threat Intelligence Data443 TacitRed Defender Threat Intelligence integrates with Microsoft Sentinel to surface early indicators of credential exposure and identity-driven risk. The solution automatically ingests compromised credential intelligence from TacitRed into Sentinel and can support synchronization of validated indicators with Microsoft Defender Threat Intelligence through Sentinel workflows, helping SOC teams detect account compromise before abuse occurs. By enriching Sentinel incidents with actionable identity context, this integration supports faster triage, proactive remediation, and stronger protection against credential-based attacks. Datawiza Access Proxy (DAP) Datawiza Access Proxy integrates with Microsoft Sentinel to provide centralized visibility into application access and authentication activity. By streaming access and MFA logs from Datawiza into Sentinel, security teams can correlate identity and session-level events with broader security telemetry. This integration supports detection of anomalous access patterns, faster investigation through session traceability, and more effective response using Sentinel automation, helping organizations strengthen Zero Trust controls and meet auditing and compliance requirements. Endace Endace integrates with Microsoft Sentinel to provide deep network visibility by providing always-on, packet-level evidence. The connector enables one-click pivoting from Sentinel alerts directly to recorded packet data captured by EndaceProbes. This helps SOC and NetOps teams reconstruct events and validate threats with confidence. By combining Sentinel’s AI-driven analytics with Endace’s always-on, full-packet capture across on-premises, hybrid, and cloud environments, this integration supports faster investigations, improved forensic accuracy, and more decisive incident response. Feedly Feedly integrates with Microsoft Sentinel to ingest curated threat intelligence directly into security operations workflows. The connector automatically imports Indicators of Compromise (IoCs) from Feedly Team Boards and folders into Sentinel, enriching detections and investigations with context from the original intelligence articles. By bringing analyst‑curated threat intelligence into Sentinel in a structured, automated way, this integration helps security teams stay current on emerging threats and reduce the manual effort required to operationalize external intelligence. Gigamon Gigamon integrates with Microsoft Sentinel through a new connector that provides access to Gigamon Application Metadata Intelligence (AMI), delivering high-fidelity network-derived telemetry with rich application metadata from inspected traffic directly into Sentinel. This added context helps security teams detect suspicious activity, encrypted threats, and lateral movement faster and with greater precision. By enriching analytics without requiring full packet ingestion, organizations can reduce noise, manage SIEM costs, and extend visibility across hybrid cloud infrastructure. Halcyon Halcyon integrates with Microsoft Sentinel to provide purpose-built ransomware detection and automated containment across the Microsoft security ecosystem. The connector surfaces Halcyon ransomware alerts directly within Sentinel, enabling SOC teams to correlate ransomware behavior with Microsoft Defender and broader Microsoft telemetry. By supporting Sentinel analytics and automation workflows, this integration helps organizations detect ransomware earlier, investigate faster using native Sentinel tools, and isolate affected endpoints to prevent lateral spread and reinfection. Illumio The Illumio platform identifies and contains threats across hybrid multi-cloud environments. By integrating AI-driven insights with Microsoft Sentinel and Microsoft Graph, Illumio Insights enables SOC analysts to visualize attack paths, prioritize high-risk activity, and investigate threats with greater precision. Illumio Segmentation secures critical assets, workloads, and devices and then publishes segmentation policy back into Microsoft Sentinel to ensure compliance monitoring. Joe Sandbox Joe Sandbox integrates with Microsoft Sentinel to enrich incidents with dynamic malware and URL analysis. The connector ingests Joe Sandbox threat intelligence and automatically detonates suspicious files and URLs associated with Sentinel incidents, returning behavioral and contextual analysis results directly into investigation workflows. By adding sandbox-driven insights to indicators, alerts, and incident comments, this integration helps SOC teams validate threats faster, reduce false positives, and improve response decisions using deeper visibility into malicious behavior. Keeper Security The Keeper Security integration with Microsoft Sentinel brings advanced password and secrets management telemetry into your SIEM environment. By streaming audit logs and privileged access events from Keeper into Sentinel, security teams gain centralized visibility into credential usage and potential misuse. The connector supports custom queries and automated playbooks, helping organizations accelerate investigations, enforce Zero Trust principles, and strengthen identity security across hybrid environments. Lookout Mobile Threat Defense (MTD) Lookout Mobile Threat Defense integrates with Microsoft Sentinel to extend SOC visibility to mobile endpoints across Android, iOS, and Chrome OS. The connector streams device, threat, and audit telemetry from Lookout into Sentinel, enabling security teams to correlate mobile risk signals such as phishing, malicious apps, and device compromise, with broader enterprise security data. By incorporating mobile threat intelligence into Sentinel analytics, dashboards, and alerts, this integration helps organizations detect mobile driven attacks earlier and strengthen protection for an increasingly mobile workforce. Miro Miro integrates with Microsoft Sentinel to provide centralized visibility into collaboration activity across Miro workspaces. The connector ingests organization-wide audit logs and content activity logs into Sentinel, enabling security teams to monitor authentication events, administrative actions, and content changes alongside other enterprise signals. By bringing Miro collaboration telemetry into Sentinel analytics and dashboards, this integration helps organizations detect suspicious access patterns, support compliance and eDiscovery needs, and maintain stronger oversight of collaborative environments without disrupting productivity. Obsidian Activity Threat The Obsidian Threat and Activity Feed for Microsoft Sentinel delivers deep visibility into SaaS and AI applications, helping security teams detect account compromise and insider threats. By streaming user behavior and configuration data into Sentinel, organizations can correlate application risks with enterprise telemetry for faster investigations. Prebuilt analytics and dashboards enable proactive monitoring, while automated playbooks simplify response workflows, strengthening security posture across critical cloud apps. OneTrust for Purview DSPM OneTrust integrates with Microsoft Sentinel to bring privacy, compliance, and data governance signals into security operations workflows. The connector enriches Sentinel with privacy relevant events and risk indicators from OneTrust, helping organizations detect sensitive data exposure, oversharing, and compliance risks across cloud and non-Microsoft data sources. By unifying privacy intelligence with Sentinel analytics and automation, this integration enables security and privacy teams to respond more quickly to data risk events and support responsible data use and AI-ready governance. Pathlock Pathlock integrates with Microsoft Sentinel to bring SAP-specific threat detection and response signals into centralized security operations. The connector forwards security-relevant SAP events into Sentinel, enabling SOC teams to correlate SAP activity with broader enterprise telemetry and investigate threats using familiar SIEM workflows. By enriching Sentinel with SAP security context and focused detection logic, this integration helps organizations improve visibility into SAP landscapes, reduce noise, and accelerate detection and response for risks affecting critical business systems. Quokka Q-scout Quokka Q-scout integrates with Microsoft Sentinel to centralize mobile application risk intelligence across Microsoft Intune-managed devices. The connector automatically ingests app inventories from Intune, analyzes them using Quokka’s mobile app vetting engines, and streams security, privacy, and compliance risk findings into Sentinel. By surfacing app-level risks through Sentinel analytics and alerts, this integration helps security teams identify malicious or high-risk mobile apps, prioritize remediation, and strengthen mobile security posture without deploying agents or disrupting users. Semperis Lightning Semperis Lightning integrates with Microsoft Sentinel to deliver deep visibility into identity‑centric risk across Active Directory and Microsoft Entra environments. The connector ingests identity security telemetry such as indicators of exposure, Tier 0 assets, and attack path insights into Sentinel, enabling security teams to correlate identity risks with broader security signals. By bringing rich identity context into Sentinel analytics, hunting, and investigations, this integration helps organizations detect, prioritize, and respond to identity‑driven attacks more effectively across hybrid identity infrastructures. Synqly Synqly integrates with Microsoft Sentinel to simplify and scale security integrations through a unified API approach. The connector enables organizations and security vendors to establish a bi‑directional connection with Sentinel without relying on brittle, point‑to‑point integrations. By abstracting common integration challenges such as authentication handling, retries, and schema changes, Synqly helps teams orchestrate security data flows into and out of Sentinel more reliably, supporting faster onboarding of new data sources and more maintainable integrations at scale. Versasec vSEC:CMS Versasec vSEC:CMS integrates with Microsoft Sentinel to provide centralized visibility into credential lifecycle and system health events. The connector securely streams vSEC:CMS and vSEC:CLOUD alerts and status data into Sentinel using the Codeless Connector Framework (CCF), transforming credential management activity into correlation-ready security signals. By bringing smart card, token, and passkey management telemetry into Sentinel, this integration helps security teams monitor authentication infrastructure health, investigate credential-related incidents, and unify identity security operations within their SIEM workflows. VirtualMetric DataStream VirtualMetric DataStream integrates with Microsoft Sentinel to optimize how security telemetry is collected, normalized, and routed across the Microsoft security ecosystem. Acting as a high-performance telemetry pipeline, DataStream intelligently filters and enriches logs, sending high-value security data to Sentinel while routing less-critical data to Sentinel data lake or Azure Blob Storage for cost-effective retention. By reducing noise upstream and standardizing logs to Sentinel ready schemas, this integration helps organizations control ingestion costs, improve detection quality, and streamline threat hunting and compliance workflows. VMRay VMRay integrates with Microsoft Sentinel to enrich SIEM and SOAR workflows with automated sandbox analysis and high-fidelity, behavior-based threat intelligence. The connector enables suspicious files and phishing URLs to be submitted directly from Sentinel to VMRay for dynamic analysis, while validated, high-confidence indicators of compromise (IOCs) are streamed back into Sentinel’s Threat Intelligence repository for correlation and detection. By adding detailed attack-chain visibility and enriched incident context, this integration helps SOC teams reduce investigation time, improve detection accuracy, and strengthen automated response workflows across Sentinel environments. XBOW XBOW integrates with Microsoft Sentinel to bring autonomous penetration testing insights directly into security operations workflows. The connector ingests automated penetration test findings from the XBOW platform into Sentinel, enabling security teams to analyze validated exploit activity alongside alerts, incidents, and other security telemetry. By correlating offensive testing results with Sentinel detections, this integration helps organizations identify monitoring gaps, validate detection coverage, and strengthen defensive controls using real‑world, continuously generated attack evidence. Zero Networks Segment Audit Zero Networks Segment integrates with Microsoft Sentinel to provide visibility into micro-segmentation and access-control activity across the network. The connector can collect audit logs or activities from Zero Networks Segment, enabling security teams to monitor policy changes, administrative actions, and access events related to MFA-based network segmentation. By bringing segmentation audit telemetry into Sentinel, this integration supports compliance monitoring, investigation of suspicious changes, and faster detection of attempts to bypass lateral-movement controls within enterprise environments. Zscaler Internet Access (ZIA) Zscaler Internet Access integrates with Microsoft Sentinel to centralize cloud security telemetry from web and firewall traffic. The connector enables ZIA logs to be ingested into Sentinel, allowing security teams to correlate Zscaler Internet Access signals with other enterprise data for improved threat detection, investigation, and response. By bringing ZIA web, firewall, and security events into Sentinel analytics and hunting workflows, this integration helps organizations gain broader visibility into internet-based threats and strengthen Zero Trust security operations. In addition to these solutions from our third-party partners, we are also excited to announce the following connector published by the Microsoft Sentinel team: GitHub Enterprise Audit Logs Microsoft’s Sentinel Promise For Customers Every connector in the Microsoft Sentinel ecosystem is built to work out of the box. In the unlikely event a customer encounters any issue with a connector, the App Assure team stands ready to assist. For Software Developers Software partners in need of assistance in creating or updating a Sentinel solution can also leverage Microsoft’s Sentinel Promise to support our shared customers. For developers seeking to build agentic experiences utilizing Sentinel data lake, we are excited to announce the launch of our Sentinel Advisory Service to guide developers across their Sentinel journey. Customers and developers alike can reach out to us via our intake form. Learn More Microsoft Sentinel data lake Microsoft Sentinel data lake: Unify signals, cut costs, and power agentic AI Introducing Microsoft Sentinel data lake What is Microsoft Sentinel data lake Unlocking Developer Innovation with Microsoft Sentinel data lake Microsoft Sentinel Codeless Connector Framework (CCF) Create a codeless connector for Microsoft Sentinel Public Preview Announcement: Microsoft Sentinel CCF Push What’s New in Microsoft Sentinel Monthly Blog Microsoft App Assure App Assure home page App Assure services App Assure blog App Assure Request Assistance Form App Assure Sentinel Advisory Services announcement App Assure’s promise: Migrate to Sentinel with confidence App Assure’s Sentinel promise now extends to Microsoft Sentinel data lake Ignite 2025 new Microsoft Sentinel connectors announcement Microsoft Security Microsoft’s Secure Future Initiative Microsoft Unified SecOps Editor's Note - April 7th, 2026: This blog was updated to include connector descriptions for BigID, Commvault, Semperis, and XBOW.How to maintain and update Azure Function Connector deployed via WEBSITE_RUN_FROM_PACKAGE?
Background We recently completed a migration from the legacy Microsoft Sentinel Box connector to the newer Box Events (CCP) connector. During the migration we discovered that the legacy Box connector was implemented using: Azure Functions JWT authentication WEBSITE_RUN_FROM_PACKAGE The Function App is configured as: WEBSITE_RUN_FROM_PACKAGE=https://aka.ms/sentinel-BoxDataConnector-functionapp and the Azure Function therefore operates in read-only mode because it is running directly from the package referenced by that URL. The migration to the new Box Events (CCP) connector has been successful and is now ingesting data into BoxEventsV2_CL using Client Credentials Grant (CCG) authentication. What prompted the question While reviewing the legacy Azure Function deployment, we noticed that: The Box Solution GitHub repository has received updates over time. The Box Solution itself has been updated (currently v3.16 in our environment). Analytics, parsers, and connector components have evolved. The legacy Azure Function deployment still appears to be tied to the original package referenced by WEBSITE_RUN_FROM_PACKAGE. This raised a broader lifecycle and maintenance question: Questions 1. Is the package referenced by: https://aka.ms/sentinel-BoxDataConnector-functionapp still actively maintained and republished by Microsoft? 2. If updates are made to the Box Solution source code or supporting files in the GitHub repository, are those updates expected to flow automatically to existing Azure Function deployments that use WEBSITE_RUN_FROM_PACKAGE? 3. If updates do not automatically flow to existing deployments, what was the intended maintenance model for customers using the legacy Azure Function connector? For example, were customers expected to: Continue using the Microsoft-hosted package URL indefinitely? Periodically redeploy using updated templates? Download and self-maintain the Function App package? Modify the Function App to stop using WEBSITE_RUN_FROM_PACKAGE? 4. Prior to the introduction of the Box Events (CCP) connector, how were customers expected to apply updates, dependency changes, security fixes, and other improvements to existing Box Azure Function deployments? 5. Is migration to the Box Events (CCP) connector now considered the only supported path for customers wishing to remain current with Microsoft Sentinel Box integrations? Reason for asking The goal is not to troubleshoot the new CCP connector. Rather, we are trying to better understand the support and maintenance lifecycle of the legacy Azure Function-based Box connector and how Microsoft intended customers to remain current when deployments were originally made using a Microsoft-hosted WEBSITE_RUN_FROM_PACKAGE endpoint. Any clarification from the Box Solution maintainers or Microsoft Sentinel team would be appreciated. NB I came across this notice after following some links from the Box Solution listed in Azure. https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/known_issues.md#known-issue-2--solution-re-deployment-or-update That seems to indicate that somehow we are meant to Redeploy the entire package when there is an update and then somehow copy / update all the Custom Analytics Rules and Automations. Is there no way to merge the new modules and updates without basically having to start over with a side-by-side deployment?Microsoft Defender: Problems with correlations in Azure Sentinel
Hi community! Sharing something we've noticed this week, in case anyone else is running into the same thing. Since around October 31, several of our environments have been generating more incidents than before. Many of the automation rules we have deployed are based on the incident title, and they're now "failing" because the alert that creates the incident is being correlated and the incident is getting a different title. On top of that, I can't base these automation rules on the analytics rule name instead, because the alert comes from Defender and that condition isn't available for it in the automation rule. In addition, some incidents from Sentinel analytics rules now show Defender-generated titles, even though they contain only a single alert. For example, the rule "Office365 Sharepoint File transfer Folders above threshold" now generates an incident called "Exfiltration incident involving one user", and "PoC - Nueva aplicación popular" now generates "Suspicious activity incident". .
MC1457836 vs docs: Sentinel in unified RBAC with a service principal or GDAP. Which is it?
This is about the article https://learn.microsoft.com/en-us/defender-xdr/activate-defender-rbac, which states: Assigning permissions to a service principal or to a GDAP user group in Microsoft Sentinel isn’t supported in unified RBAC. If you need either capability, don’t activate Sentinel in unified RBAC yet. Continue using Azure RBAC for Microsoft Sentinel. Message center notice MC1457836 announces that Microsoft automatically enables unified RBAC on all tenants between late September and late December 2026, including Sentinel Reader, Responder and Contributor workspace permissions. These two statements cannot both be followed. The article tells affected customers not to activate Sentinel; MC1457836 activates it for them. This is not hypothetical for MSSPs. We operate a managed XDR service across roughly 25 customer tenants. Both unsupported capabilities are load-bearing in that model: A service principal holds Microsoft Sentinel Contributor through Azure Lighthouse and deploys analytics rules via ARM (Microsoft.OperationalInsights/workspaces/providers/alertRules). GDAP user groups are the standard delegated access route for partners. Could this be clarified: Does the service principal and GDAP limitation also apply to tenants activated through the MC1457836 automatic rollout, or does that path behave differently? If it does apply, what is the recommended action for tenants that are auto-activated before the limitation is lifted? Is deactivating the Sentinel workload after activation the supported mitigation, and is it expected to fully restore Azure RBAC behaviour for a service principal? Can a tenant be excluded from automatic Sentinel activation in advance, rather than only opting out afterwards? The article also warns that changing permissions in the Azure portal after Sentinel is active in unified RBAC may cause sync errors. For Lighthouse-delegated permissions, which are managed outside the customer tenant entirely, is that a supported configuration once Sentinel is active? A note in the “Before you begin” section describing how this limitation interacts with the automatic rollout would help partners decide whether to pre-emptively opt out.
