Merge pull request #302833 from EdB-MSFT/lake-updates-1607-3

Stacyrch140 · web-flow · commit fefb29a04bfb · 2025-07-16T15:55:42.000-04:00
Lake updates 1607 3
diff --git a/articles/sentinel/billing-pre-purchase-plan.md b/articles/sentinel/billing-pre-purchase-plan.md
@@ -1,18 +1,18 @@
 ---
-title: Optimize costs with a pre-purchase plan
+title: Optimize costs with a prepurchase plan
 titleSuffix: Microsoft Sentinel
-description: Learn how to save costs and buy a Microsoft Sentinel pre-purchase plan
+description: Learn how to save costs and buy a Microsoft Sentinel prepurchase plan
 author: EdB-MSFT
 ms.topic: how-to
 ms.date: 07/07/2025
 ms.author: edbaynash
 
-#customerintent: As a SOC administrator or a billing specialist, I want to know how to buy a pre-purchase plan and whether commit units will benefit us financially.
+#customerintent: As a SOC administrator or a billing specialist, I want to know how to buy a prepurchase plan and whether commit units will benefit us financially.
 ---
 
 # Optimize Microsoft Sentinel costs with a pre-purchase plan
 
-Save on your Microsoft Sentinel analytics tier costs when you buy a prepurchase plan. Pre-purchase plans are commit units (CUs) bought at discounted tiers in your purchasing currency for a specific product. The more you buy, the greater the discount. Purchased CUs pay down qualifying costs in US dollars (USD). So, if Microsoft Sentinel generates a retail cost of $100, then 100 Microsoft Sentinel CUs (SCUs) are consumed. 
+Save on your Microsoft Sentinel analytics tier costs when you buy a pre-purchase plan. Pre-purchase plans are commit units (CUs) bought at discounted tiers in your purchasing currency for a specific product. The more you buy, the greater the discount. Purchased CUs pay down qualifying costs in US dollars (USD). So, if Microsoft Sentinel generates a retail cost of $100, then 100 Microsoft Sentinel CUs (SCUs) are consumed. 
 
 Your Microsoft Sentinel pre-purchase plan automatically uses your SCUs to pay for eligible analytics tier costs during its one-year term or until the SCUs run out. Your pre-purchase plan SCUs start paying for your Microsoft Sentinel workspace costs without having to redeploy or reassign the plan. By default, plans are configured to renew at the end of the one year term.
 
@@ -37,14 +37,14 @@ For example, suppose you choose a 200 GB/day commitment tier. With simplified pr
 
 A $100,000 USD pre-purchase plan covers five months of that commitment tier but is valid for paying Microsoft Sentinel costs for 12 months. The pre-purchase plan is bought at a 22% discount for $78,000 USD. 
 
-The savings for the commitment tier and the pre-purchase plan combine. The original pay-as-you-go price for five months of 200 GB/day ingestion and analysis costs is for example, about $160,000 USD. With an accurate commitment tier and a pre-purchase plan, the cost is reduced to $78,000 USD for a combined savings of over 51%. Since the example plan is depleted after just five months, the best way to ensure continued savings is to purchase more SCUs with another plan.
+The savings for the commitment tier and the pre-purchase plan combine. The original pay-as-you-go price for five months of 200 GB/day ingestion and analysis costs is, for example, about $160,000 USD. With an accurate commitment tier and a pre-purchase plan, the cost is reduced to $78,000 USD for a combined savings of over 51%. Since the example plan is depleted after just five months, the best way to ensure continued savings is to purchase more SCUs with another plan.
 
 For more information, see the following articles:
 - [Switch to simplified pricing](enroll-simplified-pricing-tier.md)
 - [Set or change commitment tier](billing-reduce-costs.md#set-or-change-pricing-tier)
 
 >[!IMPORTANT]
-> The prices mentioned are for example purposes only. To determine the latest commitment tier prices, see [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
+> The prices mentioned are for the purposes of example purposes only. To determine the latest commitment tier prices, see [Microsoft Sentinel pricing](https://azure.microsoft.com/pricing/details/microsoft-sentinel/).
 
 All Microsoft Sentinel pricing tiers qualify for Microsoft Sentinel pre-purchase plans. From your Microsoft Sentinel bill, these costs are the entries with the **Sentinel** service name in the invoice details. These costs don't include Azure Monitor tiers, retention, restore, and search costs. Eligible Microsoft Sentinel usage is deducted from the prepurchased Microsoft Sentinel CUs automatically. 
 
diff --git a/articles/sentinel/graph/sentinel-lake-connectors.md b/articles/sentinel/graph/sentinel-lake-connectors.md
@@ -33,7 +33,7 @@ To configure retention and tiering for the data connector see [Configure data co
 
  ## Microsoft Sentinel XDR data
 
-All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **System** > **Data Management** > **Table management** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
+All tables from your Microsoft Sentinel XDR connector are enabled in the data lake with 30-day retention period. Navigate to **Microsoft Sentinel** > **Configuration** > **Tables** in the Microsoft Defender portal to extend retention of the XDR tables without impacting the default retention of your analytics tier tables.
  
 Non-DCR/MMA-based custom tables aren't mirrored to the data lake. DCR-based custom tables are mirrored.
 
diff --git a/articles/sentinel/graph/sentinel-lake-onboarding.md b/articles/sentinel/graph/sentinel-lake-onboarding.md
@@ -93,7 +93,7 @@ Use the following steps to onboard to the Microsoft Sentinel data lake from the
     :::image type="content" source="./media/sentinel-lake-onboarding/onboarding-banner.png" lightbox="./media/sentinel-lake-onboarding/onboarding-banner.png" alt-text="A screenshot showing the Defender portal home page with the onboarding banner for Microsoft Sentinel data lake.":::
 
     > [!NOTE]
-    > If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** >  **Settings** > **Microsoft Sentinel** > **data lake**.
+    > If you accidentally close the banner, you can initiate onboarding by navigating to the data lake settings page under **System** >  **Settings** > **Microsoft Sentinel** > **Data lake**.
 
 
 1. If you don't have the correct roles to set up the data lake, a side panel appears indicating that you don't have the required permissions. Request that your administrator completes the onboarding process.
diff --git a/articles/sentinel/manage-table-tiers-retention.md b/articles/sentinel/manage-table-tiers-retention.md
@@ -38,7 +38,7 @@ For more information about Microsoft Sentinel workspace permissions, see [Roles
 
 To view and manage table settings in the Microsoft Defender portal:
 
-1. Select **System** > **Data management** > **Table management** from the left navigation pane.
+1. Select **Microsoft Sentinel** > **Configuration** > **Tables** from the left navigation pane.
 
     The **Table** screen lists all the tables you can manage in the Microsoft Defender portal and the settings of each table. 
 
diff --git a/articles/sentinel/media/overview/redirect-no-defender.png b/articles/sentinel/media/overview/redirect-no-defender.png
diff --git a/articles/sentinel/media/quickstart-onboard/defender-portal-initial-view.png b/articles/sentinel/media/quickstart-onboard/defender-portal-initial-view.png
diff --git a/articles/sentinel/microsoft-sentinel-defender-portal.md b/articles/sentinel/microsoft-sentinel-defender-portal.md
@@ -24,6 +24,8 @@ This article describes the Microsoft Sentinel experience in the Defender portal.
 
 [!INCLUDE [sentinel-azure-deprecation.md](includes/sentinel-azure-deprecation.md)] 
 
+[!INCLUDE [unified-soc-preview](includes/unified-soc-preview.md)]
+
 
 ## New and improved capabilities
 
diff --git a/articles/sentinel/overview.md b/articles/sentinel/overview.md
@@ -133,8 +133,32 @@ The following table highlights the key capabilities in Microsoft Sentinel for th
 
 [!INCLUDE [sentinel-azure-deprecation](includes/sentinel-azure-deprecation.md)]
 
+### Changes for new customers starting July 2025
+
+For the sake of the changes described in this section, new Microsoft Sentinel customers are customers who are [onboarding the first workspace in their tenant to Microsoft Sentinel](quickstart-onboard.md).
+
+Starting **July, 2025**, such new customers who also have the permissions of a subscription [Owner](/azure/role-based-access-control/built-in-roles#owner) or a [User access administrator](/azure/role-based-access-control/built-in-roles#user-access-administrator), and are not Azure Lighthouse-delegated users, have their workspaces automatically onboarded to the Defender portal together with onboarding to Microsoft Sentinel. 
+
+Users of such workspaces, who also aren't Azure Lighthouse-delegated users, see links in Microsoft Sentinel in the Azure portal that redirect them to the Defender portal.
+
+For example:
+
+:::image type="content" source="media/overview/redirect-no-defender.png" alt-text="Screenshot of a redirect link from the Azure portal to the Defender portal.":::
+
+Such users use Microsoft Sentinel in the Defender portal only.
+
+New customers who don't have relevant permissions aren't automatically onboarded to the Defender portal, but they do still see redirection links in the Azure portal, together with prompts to have a user with relevant permissions manually onboard the workspace to the Defender portal.
+
+The following table summarizes these experiences:
+
+|Customer type| Experience|
+|---------|---------|
+|**Existing customers** creating new workspaces in a tenant where there is already a workspace enabled for Microsoft Sentinel | Workspaces are not automatically onboarded, and users don't see redirection links |
+|**Azure Lighthouse-delegated users** creating new workspaces in any tenant | Workspaces are not automatically onboarded, and users don't see redirection links |
+|**New customers** onboarding the first workspace in their tenant to Microsoft Sentinel | - **Users who have the required permissions** have their workspace automatically onboarded. Other users of such workspaces see redirection links in the Azure portal. <br><br>- **Users who don't have the required permissions** don't have their workspace automatically onboarded. All users of such workspaces see redirection links in the Azure portal, and a user with the required permissions must onboard the workspace to the Defender portal. |
+
 ## Related content
 
-- [Quickstart: Onboard Microsoft Sentinel](quickstart-onboard.md)
+- [Onboard Microsoft Sentinel](quickstart-onboard.md)
 - [Deployment guide for Microsoft Sentinel](deploy-overview.md)
 - [Plan costs and understand Microsoft Sentinel pricing and billing](billing.md)
diff --git a/articles/sentinel/whats-new.md b/articles/sentinel/whats-new.md
@@ -21,6 +21,8 @@ The listed features were released in the last six months. For information about
 ## July 2025
 
 - [Microsoft Sentinel data lake (preview) ](#microsoft-sentinel-data-lake-preview)
+- [Table management and retention settings in the Microsoft Defender portal](#table-management-and-retention-settings-in-the-microsoft-defender-portal)
+- [Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (Preview)](#microsoft-sentinel-data-lake-permissions-integrated-with-microsoft-defender-xdr-unified-rbac-preview)
 - [No limit on the number of workspaces you can onboard to the Defender portal](#no-limit-on-the-number-of-workspaces-you-can-onboard-to-the-defender-portal)
 - [Microsoft Sentinel in the Azure portal to be retired July 2026](#microsoft-sentinel-in-the-azure-portal-to-be-retired-july-2026)
 
@@ -33,10 +35,37 @@ Key benefits of the Microsoft Sentinel data lake include:
 +	Separation of storage and compute for greater flexibility
 +	Support for multiple analytics engines to unlock deeper insights from your security data
 +	Native integration with Microsoft Sentinel, including the ability to select tiering for log data across analytics and lake tiers
+For more information, see 
 
-Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data. For more information, see [Microsoft Sentinel data lake]( graph/sentinel-lake-overview.md).
+Explore the data lake using KQL queries, or use the new Microsoft Sentinel data lake notebook for VS Code to visualize and analyze your data.
+
+For more information, see:
+
+- [Microsoft Sentinel data lake]( graph/sentinel-lake-overview.md)
+- [KQL and the Microsoft Sentinel data lake (preview)](graph/kql-overview.md) 
+- [Jupyter notebooks and the Microsoft Sentinel data lake (preview)](graph/notebooks-overview.md)
+- [Data lake tech blog](https://aka.ms/datalaketechblog)
+
+### Table management and retention settings in the Microsoft Defender portal
+
+Table management and retention settings are now available in the Microsoft Defender portals. You can view and manage table settings in the Microsoft Defender portal, including retention settings for Microsoft Sentinel and Defender XDR tables, and switch between analytics and data lake tiers.
+
+For more information, see:
++ [Manage data tiers and retention in Microsoft Sentinel (preview)](manage-data-overview.md) 
++ [Configure table settings in Microsoft Sentinel (preview)](manage-table-tiers-retention.md).
+
+
+### Microsoft Sentinel data lake permissions integrated with Microsoft Defender XDR unified RBAC (preview)
+
+Starting in July 2025, Microsoft Sentinel data lake permissions are provided through Microsoft Defender XDR unified RBAC. Support for unified RBAC is available in addition the support provided by global Microsoft Entra ID roles.
+
+For more information, see:
+
+- [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac)
+- [Create custom roles with Microsoft Defender XDR Unified RBAC](/defender-xdr/create-custom-rbac-roles)
+- [Permissions in Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/custom-permissions-details)
+- [Roles and permissions for the Microsoft Sentinel data lake (Preview)](/azure/sentinel/roles#roles-and-permissions-for-the-microsoft-sentinel-data-lake-preview)
 
-Learn more at [Data lake tech blog](https://aka.ms/datalaketechblog).
 
 ### No limit on the number of workspaces you can onboard to the Defender portal
 
