Microsoft is unifying its security experience, and one of the largest steps in that journey is the migration of Microsoft Sentinel from the Azure portal to the Microsoft Defender portal. This move brings Sentinel into the same unified interface as Microsoft Defender XDR, Microsoft Defender for Cloud, and other core security services—creating a streamlined, modern security operations workspace.
In this post, we break down what this migration means, what improvements come with it, and how SOC teams can prepare to maximize operational efficiency in the new experience.
Why the Migration? A Unified Security Operations Experience
Historically, security teams toggled between the Azure portal (for Microsoft Sentinel) and the Defender portal (for XDR and posture management tools). This created friction, fragmented workflows, and slowed down incident response.
The migration brings multiple advantages:
- Single-pane-of-glass for all security operations
Alerts, incidents, threat intelligence, assets, and hunting tools now live in the same workspace. - Unified investigation and response workflows
Analysts can pivot between Sentinel incidents and Defender XDR alerts without switching portals. - Consistent UI and navigation
The modern Defender portal offers improved performance, faster loading, and a more intuitive SOC layout. - Stronger correlation between SIEM and XDR signals
Bringing Sentinel into the Defender ecosystem strengthens cross-domain analytics and correlation.
What’s Changing in Sentinel?
Although the core Sentinel capabilities remain, the experience is reorganized and enhanced:
1. New Navigation Structure
Sentinel workspaces appear in the Defender portal under SIEM & XDR > Microsoft Sentinel.
All core elements—Incidents, Analytics rules, Logs, Automation, Watchlists, and more—are present with a refreshed layout.
2. Updated Incident Management Interface
Incidents now align visually with Defender XDR incidents, providing:
- Combined evidence view
- Consolidated timelines
- Unified tagging and categorization
- Faster drill-down across cloud, identity, device, and SaaS alerts
This improves triage consistency across SIEM + XDR.
3. Enhanced Threat Hunting Experience
KQL-based hunting is now integrated directly into the Defender “Hunting” workspace, enabling:
- Access to both Sentinel logs and Defender XDR data in one place
- Shared hunting queries
- Unified notebook investigations
- Cross-domain entity pivoting
4. Automation and Playbook Updates
Automations continue to use Logic Apps, but now benefit from:
- Centralized workflow visibility in the Defender portal
- Better integration with Copilot for Security
- Streamlined configuration paths
5. Log Access in the Defender Portal
The familiar Log Analytics query interface is embedded in the Defender portal with improved performance and cleaner UI.
KQL remains unchanged.
What’s Staying the Same?
The migration does not change:
- Your existing data connectors
- Analytics rules and scheduled queries
- Workspaces or resource group configurations
- Automation rules and Logic App playbooks
- Billing or licensing of Microsoft Sentinel
- KQL queries and Log Analytics tables
All existing configurations are preserved.
Preparing for the Migration
Here are steps organizations should take to ensure a smooth transition:
1. Update SOC Playbooks and Documentation
Revise analyst runbooks, training materials, and onboarding guides to match the new portal layout.
2. Notify SOC Analysts Early
Sentinel users should know where features have moved and what improvements to expect.
A short training session can prevent confusion during incident response.
3. Validate Automation and Permissions
Although functionality remains the same, validate that:
- RBAC roles behave as expected
- Analysts have Defender portal access
- Automation rules appear correctly post-migration
4. Evaluate New Cross-Domain Capabilities
The migration allows deeper integrations with:
- Defender XDR
- Microsoft Defender for Cloud
- Threat Intelligence
- Copilot for Security
SOC leads should explore these unified workflows to enhance detection and response maturity.
Benefits for SOC Teams
Faster Investigations
No more switching portals—SIEM + XDR incidents are unified with shared evidence and timelines.
Stronger Correlation
Defender’s analytics engine now ties together signals from cloud, identity, endpoints, and third-party sources more tightly.
Improved Usability
A modern interface, simplified navigation, and enhanced performance help analysts stay focused on threats—not portal management.
Investment in Future AI-Driven Security
Microsoft is building new AI/ML capabilities—including deep Copilot integrations—primarily in the Defender portal.
This migration ensures Sentinel benefits first from upcoming innovations.