Migrating from Sentinel to the Defender Portal

Microsoft have announced the cut off date for customers to migrate their Sentinel instance(s) to the Defender Portal by July'26, but what does that involve and is it straight forward?

The answer is it's really simple, so if you're stuck arguing the case with the business, I've put together a simple guide to demonstrate how easy it really is.

Note: This doesn't cover off the RBAC side of things, but I might look at that in another post later.

1. Navigate to security.microsoft.com where you should be prompted to connect a workspace to the Defender portal. Click Connect Workspace.

2. Select the Workspace(s) you want to connect and click Next.

3. Select the primary workspace from the dropdown and click Next.

4. Confirm you're happy with the settings selected and click Connect.

5. You'll be prompted to confirm you want to connect the specified workspace. Click Connect to accept or cancel if you want to change anything.

6. The final screen will show the new workspace connection. Click Close.

7. On the left hand menu you'll now see a selection of options for Microsoft Sentinel, allowing you to access all the capabilities that you'd normally see within the Azure Portal.

Note: The migration may take up to 24 hours for you to see all of the menu options working correctly.

Should you wish to make any changes or see the workspaces you've connected, simply go to the Settings option in the left hand menu and select Microsoft Sentinel.

Here you can see all of the Workspaces connected. In my demo instance, there's only one.

Hope that's been of some help, but as you can see, Microsoft have made it incredibly simple to carry out (even I can do it!). Let me know if you'd like to see more content like this or any deeper dives.