Merge pull request #302081 from batamig/sentinel-azure-sunset

denrea · web-flow · commit ccc9f01cc839 · 2025-07-02T09:33:16.000-07:00
Sentinel azure sunset - sentinel docs
diff --git a/articles/sentinel/includes/sentinel-azure-deprecation.md b/articles/sentinel/includes/sentinel-azure-deprecation.md
@@ -0,0 +1,23 @@
+---
+title: Microsoft Sentinel in the Azure portal retirement announcement
+description: Provides an include file for reuse of the Microsoft Sentinel in the Azure portal retirement announcement.  
+services: microsoft-sentinel
+author: batamig
+ms.topic: "include"
+ms.date: 07/01/2025
+ms.author: bagol
+ms.custom: "include file"
+---
+
+
+Microsoft Sentinel is [generally available in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md), including for customers without Microsoft Defender XDR or an E5 license. This means that you can use Microsoft Sentinel in the Defender portal even if you aren't using other Microsoft Defender services.
+
+Starting in **July 2026**, Microsoft Sentinel will be supported in the Defender portal only, and any remaining customers using the Azure portal will be automatically redirected.
+
+If you're currently using Microsoft Sentinel in the Azure portal, we recommend that you start planning your transition to the Defender portal now to ensure a smooth transition and take full advantage of the [unified security operations experience offered by Microsoft Defender](/unified-secops-platform/overview-unified-security).
+
+For more information, see:
+
+- [Microsoft Sentinel in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md)
+- [Transition your Microsoft Sentinel environment to the Defender portal](../move-to-defender.md)
+- [Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers](https://techcommunity.microsoft.com/blog/microsoft-security-blog/planning-your-move-to-microsoft-defender-portal-for-all-microsoft-sentinel-custo/4428613) (blog)
diff --git a/articles/sentinel/includes/unified-soc-preview-without-alert.md b/articles/sentinel/includes/unified-soc-preview-without-alert.md
@@ -1,6 +1,6 @@
 ---
-title: "include file" 
-description: "include file" 
+title: General Microsoft Sentinel Azure portal retirement announcement, with no extra formatting.
+description: Provides an include file for the general Microsoft Sentinel Azure portal retirement announcement, with no extra formatting.
 services: microsoft-sentinel
 author: batamig
 ms.topic: "include"
@@ -9,4 +9,4 @@ ms.author: bagol
 ms.custom: "include file"
 ---
 
-Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers without Microsoft Defender XDR or an E5 license. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md).
+[Microsoft Sentinel is generally available in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md), including for customers without Microsoft Defender XDR or an E5 license. Starting in **July 2026**, Microsoft Sentinel will be supported in the Defender portal only, and any remaining customers using the Azure portal will be automatically redirected. We recommend that any customers using Microsoft Sentinel in Azure start planning the [transition to the Defender portal](../move-to-defender.md) for the full [unified security operations experience offered by Microsoft Defender](/unified-secops-platform/overview-unified-security). For more information, see [Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers](https://techcommunity.microsoft.com/blog/microsoft-security-blog/planning-your-move-to-microsoft-defender-portal-for-all-microsoft-sentinel-custo/4428613) (blog).
diff --git a/articles/sentinel/includes/unified-soc-preview.md b/articles/sentinel/includes/unified-soc-preview.md
@@ -1,13 +1,18 @@
 ---
-title: "include file" 
-description: "include file" 
+title: General Microsoft Sentinel Azure portal retirement announcement, with extra formatting.
+description: Provides an include file for the general Microsoft Sentinel Azure portal retirement announcement, with extra formatting.
 services: microsoft-sentinel
 author: batamig
 ms.topic: "include"
-ms.date: 10/16/2024
+ms.date: 07/01/2025
 ms.author: bagol
 ms.custom: "include file"
 ---
 
 > [!IMPORTANT]
-> Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers without Microsoft Defender XDR or an E5 license. For more information, see [Microsoft Sentinel in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md).
+> [Microsoft Sentinel is generally available in the Microsoft Defender portal](../microsoft-sentinel-defender-portal.md), including for customers without Microsoft Defender XDR or an E5 license. 
+>
+> Starting in **July 2026**, Microsoft Sentinel will be supported in the Defender portal only, and any remaining customers using the Azure portal will be automatically redirected. 
+>
+> We recommend that any customers using Microsoft Sentinel in Azure start planning the [transition to the Defender portal](../move-to-defender.md) for the full [unified security operations experience offered by Microsoft Defender](/unified-secops-platform/overview-unified-security). For more information, see [Planning your move to Microsoft Defender portal for all Microsoft Sentinel customers](https://techcommunity.microsoft.com/blog/microsoft-security-blog/planning-your-move-to-microsoft-defender-portal-for-all-microsoft-sentinel-custo/4428613).
+
diff --git a/articles/sentinel/overview.md b/articles/sentinel/overview.md
@@ -20,10 +20,6 @@ Microsoft Sentinel also natively incorporates proven Azure services, like Log An
 
 Use Microsoft Sentinel to alleviate the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution time frames. This article highlights the key capabilities in Microsoft Sentinel.
 
-
-[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
-
-
 Microsoft Sentinel inherits the Azure Monitor [tamper-proofing and immutability](/azure/azure-monitor/logs/data-security#tamper-proofing-and-immutability) practices. While Azure Monitor is an append-only data platform, it includes provisions to delete data for compliance purposes.
 
 [!INCLUDE [azure-lighthouse-supported-service](../../includes/azure-lighthouse-supported-service-no-note.md)]
@@ -120,6 +116,10 @@ The following table highlights the key capabilities in Microsoft Sentinel for th
 |Automation rules|Centrally manage the automation of incident handling in Microsoft Sentinel by defining and coordinating a small set of rules that cover different scenarios. |[Automate threat response in Microsoft Sentinel with automation rules](automate-incident-handling-with-automation-rules.md)|
 |Playbooks|Automate and orchestrate your threat response by using playbooks, which are a collection of remediation actions. Run a playbook on-demand or automatically in response to specific alerts or incidents, when triggered by an automation rule. <br><br>  To build playbooks with Azure Logic Apps, choose from a constantly expanding gallery of connectors for various services and systems like ServiceNow, Jira, and more. These connectors allow you to apply any custom logic in your workflow. |[Automate threat response with playbooks in Microsoft Sentinel](automate-responses-with-playbooks.md)<br><br>[List of all Logic App connectors](/connectors/connector-reference/connector-reference-logicapps-connectors)|
 
+## Microsoft Sentinel in the Azure portal retirement timeline
+
+[!INCLUDE [sentinel-azure-deprecation](includes/sentinel-azure-deprecation.md)]
+
 ## Related content
 
 - [Quickstart: Onboard Microsoft Sentinel](quickstart-onboard.md)
diff --git a/articles/sentinel/whats-new.md b/articles/sentinel/whats-new.md
@@ -4,7 +4,7 @@ description: Learn about the latest new features and announcement in Microsoft S
 author: batamig
 ms.author: bagol
 ms.topic: concept-article
-ms.date: 06/15/2025
+ms.date: 07/01/2025
 #Customer intent: As a security team member, I want to stay updated on the latest features and enhancements in Microsoft Sentinel so that I can effectively manage and optimize my organization's security posture.
 ms.custom:
   - build-2025
@@ -18,6 +18,12 @@ The listed features were released in the last six months. For information about
 
 [!INCLUDE [reference-to-feature-availability](includes/reference-to-feature-availability.md)]
 
+## July 2025
+
+### Microsoft Sentinel in the Defender portal to be retired July 2026
+
+[!INCLUDE [sentinel-azure-deprecation](includes/sentinel-azure-deprecation.md)]
+
 ## June 2025
 
 - [Codeless Connector Platform (CCP) renamed.](#codeless-connector-platform-ccp-renamed-to-codeless-connector-framework-ccf)
