Skip to content

Commit c52ed78

Browse files
cwatson-catcwatson-cat
committed
Sentinel - upd and separate remove Sentinel content
1 parent 156808a commit c52ed78

File tree

4 files changed

+184
-139
lines changed

4 files changed

+184
-139
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1127,8 +1127,12 @@
11271127
href: monitor-analytics-rule-integrity.md
11281128
- name: Auditing Microsoft Sentinel with Azure Activity Logs
11291129
href: audit-sentinel-data.md
1130-
- name: Remove Microsoft Sentinel from your workspaces
1131-
href: offboard.md
1130+
- name: Remove Microsoft Sentinel from your workspace
1131+
items:
1132+
- name: Overview
1133+
href: offboard-implications.md
1134+
- name: Remove Microsoft Sentinel
1135+
href: offboard.md
11321136
- name: Troubleshoot
11331137
items:
11341138
- name: Troubleshoot AWS S3 connector issues

‎articles/sentinel/media/offboard/defender-settings-remove-sentinel.png

51.2 KB
Loading

‎articles/sentinel/offboard-implications.md

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
---
2+
title: Implications - remove Microsoft Sentinel from workspace
3+
description: Learn about the results of removing a Microsoft Sentinel instance for a Log Analytics workspacel.
4+
author: cwatson-cat
5+
ms.topic: concept-article
6+
ms.date: 02/05/2025
7+
ms.author: cwatson
8+
appliesto:
9+
- Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
10+
11+
#Customer intent: As an IT admin, I want to understand the implications of removing Microsoft Sentinel from my Log Analytics workspace so that I can make an informed choice about discontining its use and managing associated costs and configurations.
12+
13+
---
14+
15+
# Implications of removing Microsoft Sentinel from your workspace
16+
17+
If you decide that you no longer want to use your Microsoft Sentinel instance associated with a Log Analytics workspace, remove Microsoft Sentinel from the workspace. But before you do, consider the implications described in this article.
18+
19+
It can take up to 48 hours for Microsoft Sentinel to be removed from the Log Analytics workspace. Data connector configuration and Microsoft Sentinel tables are deleted. Other resources and data are retained for a limited time.
20+
21+
Your subscription continues to be registered with the Microsoft Sentinel resource provider. But, you can remove it manually.
22+
23+
If you don't want to keep the workspace and the data collected for Microsoft Sentinel, delete the resources associated with the workspace in the Azure portal.
24+
25+
## Consider pricing changes
26+
When Microsoft Sentinel is removed from a workspace, there might still be costs associated with the data in Azure Monitor Log Analytics. For more information on the effect to commitment tier costs, see [Simplified billing offboarding behavior](enroll-simplified-pricing-tier.md#offboarding-behavior).
27+
28+
## Data connector configurations removed
29+
30+
The configurations for the following data connector are removed when you remove Microsoft Sentinel from your workspace.
31+
32+
- Microsoft 365
33+
34+
- Amazon Web Services
35+
36+
- Microsoft services security alerts:
37+
38+
- Microsoft Defender for Identity
39+
- Microsoft Defender for Cloud Apps including Cloud Discovery Shadow IT reporting
40+
- Microsoft Entra ID Protection
41+
- Microsoft Defender for Endpoint
42+
- Microsoft Defender for Cloud
43+
44+
- Threat Intelligence
45+
46+
- Common security logs including CEF-based logs, Barracuda, and Syslog. If you get security alerts from Microsoft Defender for Cloud, these logs continue to be collected.
47+
48+
- Windows Security Events. If you get security alerts from Microsoft Defender for Cloud, these logs continue to be collected.
49+
50+
Within the first 48 hours, the data and analytics rules, which include real-time automation configuration, are no longer accessible or queryable in Microsoft Sentinel.
51+
52+
## Resources removed
53+
54+
The following resources are removed after 30 days:
55+
56+
- Incidents (including investigation metadata)
57+
58+
- Analytics rules
59+
60+
- Bookmarks
61+
62+
Your playbooks, saved workbooks, saved hunting queries, and notebooks aren't removed. Some of these resources might break due to the removed data. Remove those resources manually.
63+
64+
After you remove the service, there's a grace period of 30 days to re-enable Microsoft Sentinel. Your data and analytics rules are restored, but the configured connectors that were disconnected must be reconnected.
65+
66+
## Microsoft Sentinel tables deleted
67+
68+
When you remove Microsoft Sentinel from your workspace, all Microsoft Sentinel tables are deleted. The data in these tables aren't accessible or queryable. But, the data retention policy set for those tables applies to the data in the deleted tables. So, if you re-enable Microsoft Sentinel on the workspace within the data retention time period, the retained data is restored to those tables.
69+
70+
The tables and related data that are inaccessible when you remove Microsoft Sentinel include but aren't limited to the following tables:
71+
72+
- `AlertEvidence`
73+
- `AlertInfo`
74+
- `Anomalies`
75+
- `ASimAuditEventLogs`
76+
- `ASimAuthenticationEventLogs`
77+
- `ASimDhcpEventLogs`
78+
- `ASimDnsActivityLogs`
79+
- `ASimFileEventLogs`
80+
- `ASimNetworkSessionLogs`
81+
- `ASimProcessEventLogs`
82+
- `ASimRegistryEventLogs`
83+
- `ASimUserManagementActivityLogs`
84+
- `ASimWebSessionLogs`
85+
- `AWSCloudTrail`
86+
- `AWSCloudWatch`
87+
- `AWSGuardDuty`
88+
- `AWSVPCFlow`
89+
- `CloudAppEvents`
90+
- `CommonSecurityLog`
91+
- `ConfidentialWatchlist`
92+
- `DataverseActivity`
93+
- `DeviceEvents`
94+
- `DeviceFileCertificateInfo`
95+
- `DeviceFileEvents`
96+
- `DeviceImageLoadEvents`
97+
- `DeviceInfo`
98+
- `DeviceLogonEvents`
99+
- `DeviceNetworkEvents`
100+
- `DeviceNetworkInfo`
101+
- `DeviceProcessEvents`
102+
- `DeviceRegistryEvents`
103+
- `DeviceTvmSecureConfigurationAssessment`
104+
- `DeviceTvmSecureConfigurationAssessmentKB`
105+
- `DeviceTvmSoftwareInventory`
106+
- `DeviceTvmSoftwareVulnerabilities`
107+
- `DeviceTvmSoftwareVulnerabilitiesKB`
108+
- `DnsEvents`
109+
- `DnsInventory`
110+
- `Dynamics365Activity`
111+
- `DynamicSummary`
112+
- `EmailAttachmentInfo`
113+
- `EmailEvents`
114+
- `EmailPostDeliveryEvents`
115+
- `EmailUrlInfo`
116+
- `GCPAuditLogs`
117+
- `GoogleCloudSCC`
118+
- `HuntingBookmark`
119+
- `IdentityDirectoryEvents`
120+
- `IdentityLogonEvents`
121+
- `IdentityQueryEvents`
122+
- `LinuxAuditLog`
123+
- `McasShadowItReporting`
124+
- `MicrosoftPurviewInformationProtection`
125+
- `NetworkSessions`
126+
- `OfficeActivity`
127+
- `PowerAppsActivity`
128+
- `PowerAutomateActivity`
129+
- `PowerBIActivity`
130+
- `PowerPlatformAdminActivity`
131+
- `PowerPlatformConnectorActivity`
132+
- `PowerPlatformDlpActivity`
133+
- `ProjectActivity`
134+
- `SecurityAlert`
135+
- `SecurityEvent`
136+
- `SecurityIncident`
137+
- `SentinelAudit`
138+
- `SentinelHealth`
139+
- `ThreatIntelligenceIndicator`
140+
- `UrlClickEvents`
141+
- `Watchlist`
142+
- `WindowsEvent`
143+
144+
## Related resources
145+
146+
- [Remove Microsoft Sentinel from your Log Analytics workspace](offboard.md)
147+
- [Offboard Microsoft Sentinel from the Defender portal](/defender-xdr/microsoft-sentinel-onboard?view=o365-worldwide#offboard-microsoft-sentinel).

‎articles/sentinel/offboard.md

Lines changed: 31 additions & 137 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,42 @@
11
---
2-
title: Remove Microsoft Sentinel from your workspace
3-
description: Learn how to delete your Microsoft Sentinel instance.
2+
title: Remove Microsoft Sentinel from your workspace
3+
description: Learn how to delete your Microsoft Sentinel instance to discontinue use of Microsoft Sentinel and associated costs.
44
author: cwatson-cat
55
ms.topic: how-to
6-
ms.date: 03/06/2024
6+
ms.date: 02/05/2025
77
ms.author: cwatson
8+
appliesto:
9+
- Microsoft Sentinel in the Azure portal and the Microsoft Defender portal
810

911

1012
#Customer intent: As an IT admin, I want to remove Microsoft Sentinel from my Log Analytics workspace so that I can discontinue its use and manage associated costs and configurations.
1113

1214
---
1315

14-
# Remove Microsoft Sentinel from your workspace
16+
# Remove Microsoft Sentinel from your Log Analytics workspace
1517

16-
If you no longer want to use Microsoft Sentinel, this article explains how to remove it from your Log Analytics workspace. Review the implications of removing Microsoft Sentinel before you complete these steps.
18+
If you no longer want to use Microsoft Sentinel, this article explains how to remove it from your Log Analytics workspace.
19+
20+
If you want to offboard Microsoft Sentinel from the Defender portal, see [Offboard Microsoft Sentinel](/defender-xdr/microsoft-sentinel-onboard?view=o365-worldwide#offboard-microsoft-sentinel).
21+
22+
## Prerequisites
23+
24+
Before you begin, review [Implications of removing Microsoft Sentinel from your workspace](offboard-implications.md).
1725

1826
## Remove Microsoft Sentinel
1927

2028
Complete the following steps to remove Microsoft Sentinel from your Log Analytics workspace.
2129

22-
1. For Microsoft Sentinel in the [Azure portal](https://portal.microsoft.com), under **Configuration**, select **Settings**.
30+
1. For Microsoft Sentinel in the [Azure portal](https://portal.microsoft.com), under **Configuration**, select **Settings**.<br>On the **Settings** page, select the **Settings** tab.<br><br> For Microsoft Sentinel in the [Defender portal](https://security.microsoft.com/), select **System** > **Settings** > **Microsoft Sentinel**.
2331

24-
1. On the **Settings** page, select the **Settings** tab.
32+
1. Select **Remove Microsoft Sentinel**.
2533

26-
1. At the bottom of the list, select **Remove Microsoft Sentinel**.
34+
#### [Azure portal](#tab/azure-portal)
35+
:::image type="content" source="media/offboard/locate-remove-sentinel.png" alt-text="Screenshot to find the setting to remove Microsoft Sentinel from your workspace in the Azure portal.":::
2736

28-
:::image type="content" source="media/offboard/locate-remove-sentinel.png" alt-text="Screenshot to find the setting to remove Microsoft Sentinel from your workspace.":::
37+
#### [Defender portal](#tab/defender-portal)
38+
:::image type="content" source="media/offboard/defender-settings-remove-sentinel.png" alt-text="Screenshot of Microsoft Sentinel settings in the Defender portal with the option to remove Microsoft Sentinel highlighted toward the end of the list.":::
39+
----
2940

3041
1. Review the **Know before you go...** section and the rest of this document carefully. Take all the necessary actions before proceeding.
3142

@@ -35,132 +46,15 @@ Complete the following steps to remove Microsoft Sentinel from your Log Analytic
3546

3647
:::image type="content" source="media/offboard/remove-sentinel-reasons.png" alt-text="Screenshot that shows the section to remove the Microsoft Sentinel solution from your workspace.":::
3748

38-
## Consider pricing changes
39-
When Microsoft Sentinel is removed from a workspace, there might still be costs associated with the data in Azure Monitor Log Analytics. For more information on the effect to commitment tier costs, see [Simplified billing offboarding behavior](enroll-simplified-pricing-tier.md#offboarding-behavior).
40-
41-
## Review implications
42-
43-
It can take up to 48 hours for Microsoft Sentinel to be removed from the Log Analytics workspace. Data connector configuration and Microsoft Sentinel tables are deleted. Other resources and data are retained for a limited time.
44-
45-
Your subscription continues to be registered with the Microsoft Sentinel resource provider. But, you can remove it manually.
46-
47-
### Data connector configurations removed
48-
49-
The configurations for the following data connector are removed when you remove Microsoft Sentinel from your workspace.
50-
51-
- Microsoft 365
52-
53-
- Amazon Web Services
54-
55-
- Microsoft services security alerts:
56-
57-
- Microsoft Defender for Identity
58-
- Microsoft Defender for Cloud Apps including Cloud Discovery Shadow IT reporting
59-
- Microsoft Entra ID Protection
60-
- Microsoft Defender for Endpoint
61-
- Microsoft Defender for Cloud
62-
63-
- Threat Intelligence
64-
65-
- Common security logs including CEF-based logs, Barracuda, and Syslog. If you get security alerts from Microsoft Defender for Cloud, these logs continue to be collected.
66-
67-
- Windows Security Events. If you get security alerts from Microsoft Defender for Cloud, these logs continue to be collected.
68-
69-
Within the first 48 hours, the data and analytics rules, which include real-time automation configuration, are no longer accessible or queryable in Microsoft Sentinel.
70-
71-
### Resources removed
72-
73-
The following resources are removed after 30 days:
74-
75-
- Incidents (including investigation metadata)
76-
77-
- Analytics rules
78-
79-
- Bookmarks
80-
81-
Your playbooks, saved workbooks, saved hunting queries, and notebooks aren't removed. Some of these resources might break due to the removed data. Remove those resources manually.
82-
83-
After you remove the service, there's a grace period of 30 days to re-enable Microsoft Sentinel. Your data and analytics rules are restored, but the configured connectors that were disconnected must be reconnected.
84-
85-
### Microsoft Sentinel tables deleted
86-
87-
When you remove Microsoft Sentinel from your workspace, all Microsoft Sentinel tables are deleted. The data in these tables aren't accessible or queryable. But, the data retention policy set for those tables applies to the data in the deleted tables. So, if you re-enable Microsoft Sentinel on the workspace within the data retention time period, the retained data is restored to those tables.
88-
89-
The tables and related data that are inaccessible when you remove Microsoft Sentinel include but aren't limited to the following tables:
90-
91-
- `AlertEvidence`
92-
- `AlertInfo`
93-
- `Anomalies`
94-
- `ASimAuditEventLogs`
95-
- `ASimAuthenticationEventLogs`
96-
- `ASimDhcpEventLogs`
97-
- `ASimDnsActivityLogs`
98-
- `ASimFileEventLogs`
99-
- `ASimNetworkSessionLogs`
100-
- `ASimProcessEventLogs`
101-
- `ASimRegistryEventLogs`
102-
- `ASimUserManagementActivityLogs`
103-
- `ASimWebSessionLogs`
104-
- `AWSCloudTrail`
105-
- `AWSCloudWatch`
106-
- `AWSGuardDuty`
107-
- `AWSVPCFlow`
108-
- `CloudAppEvents`
109-
- `CommonSecurityLog`
110-
- `ConfidentialWatchlist`
111-
- `DataverseActivity`
112-
- `DeviceEvents`
113-
- `DeviceFileCertificateInfo`
114-
- `DeviceFileEvents`
115-
- `DeviceImageLoadEvents`
116-
- `DeviceInfo`
117-
- `DeviceLogonEvents`
118-
- `DeviceNetworkEvents`
119-
- `DeviceNetworkInfo`
120-
- `DeviceProcessEvents`
121-
- `DeviceRegistryEvents`
122-
- `DeviceTvmSecureConfigurationAssessment`
123-
- `DeviceTvmSecureConfigurationAssessmentKB`
124-
- `DeviceTvmSoftwareInventory`
125-
- `DeviceTvmSoftwareVulnerabilities`
126-
- `DeviceTvmSoftwareVulnerabilitiesKB`
127-
- `DnsEvents`
128-
- `DnsInventory`
129-
- `Dynamics365Activity`
130-
- `DynamicSummary`
131-
- `EmailAttachmentInfo`
132-
- `EmailEvents`
133-
- `EmailPostDeliveryEvents`
134-
- `EmailUrlInfo`
135-
- `GCPAuditLogs`
136-
- `GoogleCloudSCC`
137-
- `HuntingBookmark`
138-
- `IdentityDirectoryEvents`
139-
- `IdentityLogonEvents`
140-
- `IdentityQueryEvents`
141-
- `LinuxAuditLog`
142-
- `McasShadowItReporting`
143-
- `MicrosoftPurviewInformationProtection`
144-
- `NetworkSessions`
145-
- `OfficeActivity`
146-
- `PowerAppsActivity`
147-
- `PowerAutomateActivity`
148-
- `PowerBIActivity`
149-
- `PowerPlatformAdminActivity`
150-
- `PowerPlatformConnectorActivity`
151-
- `PowerPlatformDlpActivity`
152-
- `ProjectActivity`
153-
- `SecurityAlert`
154-
- `SecurityEvent`
155-
- `SecurityIncident`
156-
- `SentinelAudit`
157-
- `SentinelHealth`
158-
- `ThreatIntelligenceIndicator`
159-
- `UrlClickEvents`
160-
- `Watchlist`
161-
- `WindowsEvent`
162-
163-
## Next steps
164-
165-
In this document, you learned how to remove the Microsoft Sentinel service. If you change your mind and want to install it again, see [Quickstart: Onboard Microsoft Sentinel](quickstart-onboard.md).
49+
## Clean up resources in the Azure portal (optional)
50+
51+
If you don't want to keep the workspace and the data collected for Microsoft Sentinel, delete the resources associated with the workspace in the Azure portal.
52+
53+
54+
- Delete just the individual resources within the associated resource group that you no longer need. For more information, see [Delete resource](/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-portal#delete-resource).
55+
- Or, if you don't need any of the resources in the associated resource group, delete the resource group. For more information, see [Delete resource group](/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-portal).
56+
57+
## Related resources
58+
59+
If you change your mind and want to install Microsoft Sentinel again, see [Quickstart: Onboard Microsoft Sentinel](quickstart-onboard.md).
16660

0 commit comments

Comments
 (0)