Automatic onboarding for Microsoft Sentinel
Microsoft Sentinel automatic onboarding for managed customers begins in September 2026.
- Impacted audience
- Managed security service providers (MSSPs) and partners managing Microsoft Sentinel customers
Starting in September 2026, Microsoft will begin automatically onboarding managed customers that didn't move to the unified Microsoft Sentinel experience in the Microsoft Defender portal.
Microsoft will manage the scheduling, customer notifications, and technical onboarding. Affected tenant administrators receive an in-portal banner and admin email about 30 days before their onboarding date. Existing third-party connectors, content, and data remain in place.
What this change means for you
To prepare for this change, review customers with multiple Microsoft Sentinel workspaces and consider the following information:
- Microsoft selects one primary workspace for Microsoft Defender XDR alerts and incidents.
- XDR-dependent content in secondary workspaces might stop functioning after the primary workspace is established.
- To maintain content from secondary workspaces, migrate affected analytics rules, automation rules, playbooks, and workbooks to the primary workspace.
- For special handling or to request a different primary workspace, email MSSP-Sentinel-Support@microsoft.com with the tenant ID and preferred workspace resource ID.
No action is required for other managed customers.
As a related reminder, the Microsoft Sentinel experience in the Azure portal retires on March 31, 2027.
Next steps
Learn more about Microsoft Sentinel in the Microsoft Defender portal.