Microsoft Sentinel, still widely called Azure Sentinel, is not going away, but its home is. After March 31, 2027, Microsoft will no longer support Sentinel in the Azure portal, and it will be available only in the Microsoft Defender portal.
That date has already slipped once. Microsoft first targeted July 1, 2026, then extended the deadline by nine months. With roughly five months left as of late October 2026, security teams still working in the Azure portal need a plan now.
The product and its data platform stay in place. Log Analytics remains the data backbone underneath Sentinel. What changes is where analysts work, how incidents are built, and how access is managed.
How the deadline moved
Microsoft has changed the Azure portal retirement date once, from July 1, 2026 to March 31, 2027. Sentinel has been usable in the Defender portal throughout.
When
What happened
March 31, 2027
Sentinel no longer supported in the Azure portal; all customers use the Defender portal (Microsoft Learn)
February 2026
Microsoft extends the timeline from July 1, 2026 to March 31, 2027, nine months more for customers and partners (Microsoft Q&A, Cloud Factory)
2025
Microsoft announces a target to retire the Azure portal experience by July 1, 2026, with automatic redirects to the Defender portal (Microsoft Security blog)
November 2023
Microsoft announces its strategy to unify security operations by bringing XDR and SIEM together (Microsoft Security blog)
New customers are already onboarded to the Defender portal. Those onboarding their tenant’s first Sentinel workspace with Owner or User Access Administrator rights, and not through Azure Lighthouse, go straight there (KeMeT Tech).
Why Microsoft is doing this
The move merges SIEM and XDR into one workspace for security operations. Splitting detection and response across two portals adds overhead for stretched SOC teams, and Microsoft’s pitch is a single place for incidents, hunting, automation and AI tooling (Planet Technologies).
Microsoft also points to what the unified portal enables:
One incident queue. Alerts from Sentinel and Defender XDR feed a shared incident model, so related alerts are correlated into one incident (Cloud Direct).
Third-party data alongside Defender data. One early adopter quoted by Microsoft called combining Defender XDR data with third-party tool logs the biggest benefit (Microsoft Security blog).
New capabilities. Microsoft is concentrating new work in the Defender portal, including the Sentinel data lake and Security Copilot integration (Cloud Factory).
Microsoft describes the Defender portal as a foundation for integrated, AI-driven security operations, not just a new home for Sentinel.
What changes for security teams
Most of the work carries over, but several things behave differently. The items below are the ones that most often need attention.
Area
What to expect
Data platform
Azure Log Analytics remains the underlying data platform (Cloud Direct).
Cost
One consultancy reports that moving to the Defender portal is free, even without E5 licensing (KeMeT Tech). Confirm with your Microsoft rep.
Correlation
Sentinel’s legacy Fusion engine is disabled, and correlation runs through Defender XDR logic (Cloud Direct). Compare incident counts and grouping against the Azure portal view.
Permissions
Connecting Sentinel does not replace Azure RBAC, and existing permissions still grant access to Sentinel features. Some workbook, playbook and Azure resource permissions stay Azure-managed (Jesse Kurien). Defender also uses unified RBAC, so plan for both.
Workspaces
You pick one primary workspace per tenant (KeMeT Tech).
Multi-tenant management
Workspace Manager is not available in the Defender portal. Use repository deployment from GitHub or Azure DevOps, or the Defender multitenant portal (KeMeT Tech).
Playbooks
Existing playbooks keep working during the transition, but plan to move them to the unified Microsoft Sentinel connector before the deadline (Protego).
Workbooks and links
Azure workbooks still work as before. Any saved links to portal.azure.com blade URLs will break after retirement (KeMeT Tech, Protego).
Analytics rules
Rules carry over and are managed under Sentinel > Analytics in the Defender portal. Validate each rule’s behavior before you stop using the Azure portal (Protego, Aufait).
Practitioners who have migrated customers also report rough edges, including missing API features and incident correlation issues, alongside real value in the single-portal experience (The Collective podcast).
How to prepare before March 31, 2027
Start with an inventory, then onboard a test tenant or workspace and compare behavior side by side.
Inventory workspaces, analytics rules, playbooks, workbooks and saved links, and choose your primary workspace.
Review RBAC in both Azure and the Defender portal, and decide who needs which role.
Connect the workspace to the Defender portal. Microsoft copies configuration without deleting anything from the Azure portal (Protego).
Test incident grouping and compare counts with the Azure portal view.
Update playbooks to the unified connector and fix any links to Azure portal blades.
Replace Workspace Manager workflows with repository deployment or the Defender multitenant portal if you manage several workspaces.
Train analysts on the unified incident queue and hunting experience before cutover.
Regulated organizations should treat this as a controlled platform change and document checks on permissions, retention, logging and incident response continuity (IT Knowledge Lab).
Microsoft’s own guidance is to use the Defender portal’s built-in documentation and in-product support, and to start now. Check the Microsoft Learn what’s new page for any further date changes.