Skip to content

Commit 3a0b8e4

Browse files
batamigbatamig
committed
moving to tables
1 parent e225832 commit 3a0b8e4

File tree

1 file changed

+37
-102
lines changed

1 file changed

+37
-102
lines changed

‎unified-secops-platform/transition.md‎

Lines changed: 37 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: Transitioning to Microsoft's unified SecOps platform
2+
title: Moving to Microsoft's unified SecOps platform
33
description: Learn about the different security roles involved in transitioning to Microsoft's unified SecOps platform from Microsoft Sentinel in the Azure portal.
44
ms.service: unified-secops-platform
55
ms.author: bagol
@@ -13,17 +13,17 @@ ms.topic: conceptual
1313
# customer intent: As a security professional, I want to understand the benefits and process of transitioning to Microsoft's unified SecOps platform so I can effectively plan my organization's migration from the standalone Microsoft Sentinel portal before its decommissioning.
1414
---
1515

16-
# Transition to Microsoft's unified SecOps platform
16+
# Moving to Microsoft's unified SecOps platform
1717

1818
Microsoft's unified security operations (SecOps) platform provides a single platform for end-to-end security operations (SecOps). This platform combines services like [Microsoft Defender XDR](/defender-xdr/microsoft-365-defender), [Microsoft Sentinel](/azure/sentinel/overview), [Microsoft Security Exposure Management](/security-exposure-management/microsoft-security-exposure-management), and [Microsoft Security Copilot](/copilot/security/microsoft-security-copilot) within the Microsoft Defender portal. The unified SecOps platform provides multi-tenant and multi-workspace capabilities, a single incident queue, alert correlation, and automatic attack disruption to ensure streamlined workflows and enhances security operations efficiency.
1919

20-
Starting in May 2026, customers using the Microsoft Sentinel experience in the Azure portal will be redirected to the unified SecOps platform in the Microsoft Defender portal. Microsoft Sentinel in the Azure portal will be decommissioned on July 1, 2026. To prepare for this change, we recommend that customers that are still using the Microsoft Sentinel experience in the Azure portal proactively transition to Microsoft's unified SecOps platform in the Microsoft Defender portal.
20+
Starting in May 2026, customers using the Microsoft Sentinel experience in the Azure portal will be redirected to the unified SecOps platform in the Microsoft Defender portal. Microsoft Sentinel in the Azure portal will be decommissioned on July 1, 2026. To prepare for this change, we recommend that customers that are still using the Microsoft Sentinel experience in the Azure portal proactively move to Microsoft's unified SecOps platform in the Microsoft Defender portal.
2121

2222
For more information, see the relevant documentation for each feature and [Capability differences between portals](/azure/sentinel/microsoft-sentinel-defender-portal##capability-differences-between-portals).
2323

24-
## Benefits of transitioning to the unified SecOps platform
24+
## Benefits of moving to unified SecOps
2525

26-
Transitioning to the unified SecOps platform offers the following benefits, and more:
26+
Moving to the unified SecOps platform offers the following benefits, and more:
2727

2828
| **Benefit** | **Description** |
2929
|--------------------|--------------------------------------------|
@@ -37,115 +37,50 @@ Transitioning to the unified SecOps platform offers the following benefits, and
3737

3838
For more information, see [Microsoft Sentinel in the Microsoft Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal).
3939

40-
## Transition to unified SecOps as a security architect
40+
## Move to unified SecOps as a security architect
4141

42-
The following content is relevant for security architects on a SecOps team that's transitioning from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
42+
The following content is relevant for security architects on a SecOps team that's moving from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
4343

44-
- **Access**:
4544

46-
[!INCLUDE [mininum-access-requirements](includes/mininum-access-requirements.md)]
45+
| Feature | Details |
46+
|---------|---------|
47+
|**Access** | - [Plan roles and permissions](overview-plan.md#plan-roles-and-permissions), including role-based access control (RBAC) <br> - [Configure roles and permissions](overview-deploy.md#configure-roles-and-permissions) <br><br> The minimal required permission for an analyst to view Microsoft Sentinel data is to delegate permissions for the Azure RBAC Sentinel Reader role. These permissions are also applied to the unified portal. Without these permissions, the Microsoft Sentinel navigation menu isn't available on the unified portal, despite the analyst having access to the Microsoft Defender portal. <br><br>A best practice is to have all Microsoft Sentinel related resources in the same Azure resource group, then delegate Microsoft Sentinel role permissions (like the Sentinel Reader role) at the resource group level that contains the Microsoft Sentinel workspace. By doing this, the role assignment applies to all the resources that support Microsoft Sentinel. |
48+
|**Multiple workspaces and tenants** | - [Multiple Microsoft Sentinel workspaces in the Defender portal](/azure/sentinel/prepare-multiple-workspaces) <br>- [Extend Microsoft Sentinel across workspaces and tenants](/azure/sentinel/extend-sentinel-across-workspaces-tenants) <br> - [Microsoft Defender multitenant management](mto-overview.md) |
49+
|**Log tiering and retention** | - [When to use auxiliary logs in Microsoft Sentinel](/azure/sentinel/basic-logs-use-cases) <br>- [Log retention plans in Microsoft Sentinel](/azure/sentinel/log-plans)<br> - [Set up a table with the Auxiliary plan for low-cost data ingestion and retention in your Log Analytics workspace](/azure/azure-monitor/logs/create-custom-table-auxiliary) <br> - [Microsoft Sentinel in the Defender portal: threat management](/azure/sentinel/microsoft-sentinel-defender-portal#threat-management) <br><br>Microsoft Sentinel classifies security data as primary security data and secondary security data. For primary security data, which you want to monitor closely, we recommend the analytic tier. For secondary security data, we recommend auxiliary. Both types of data are accessible for queries in the **Advanced hunting** page in the Defender portal. |
4750

48-
- [Plan roles and permissions](overview-plan.md#plan-roles-and-permissions), including role-based access control (RBAC)
49-
- [Configure roles and permissions](overview-deploy.md#configure-roles-and-permissions)
50-
51-
- **Multiple workspaces and tenants**:
51+
## Move to unified SecOps as a security engineer
5252

53-
- [Multiple Microsoft Sentinel workspaces in the Defender portal](/azure/sentinel/prepare-multiple-workspaces)
54-
- [Extend Microsoft Sentinel across workspaces and tenants](/azure/sentinel/extend-sentinel-across-workspaces-tenants)
55-
- [Microsoft Defender multitenant management](mto-overview.md)
53+
The following content is relevant for security engineers on a SecOps team that's moving from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
5654

57-
- **Log tiering and retention**:
5855

59-
Microsoft Sentinel classifies security data as primary security data and secondary security data. For primary security data, which you want to monitor closely, we recommend the analytic tier. For secondary security data, we recommend auxiliary. Both types of data are accessible for queries in the **Advanced hunting** page in the Defender portal.
56+
| Feature | Details |
57+
|---------|---------|
58+
|**Data collection** | - [Microsoft Sentinel data connectors](/azure/sentinel/connect-data-sources?tabs=defender-portal) <br>- Experience in the Defender portal: [Visibility of connectors used by the unified security operations platform](/azure/sentinel/microsoft-sentinel-defender-portal), [Defender for Cloud](/azure/sentinel/microsoft-sentinel-defender-portal), and [DLP data](/azure/sentinel/microsoft-sentinel-defender-portal) |
59+
|**Automation** | [Automation in the Microsoft Defender portal](/azure/sentinel/automation/automation#automation-in-the-microsoft-defender-portal) |
60+
|**Ecosystem** | Distribute content across workspaces using one of the following methods: <br> - [Deploy content as code from your repository](/azure/sentinel/ci-cd)<br> - [Microsoft Defender multitenant management](mto-overview.md) |
61+
|**SOC optimization** | [Optimize your security operations](/azure/sentinel/soc-optimization/soc-optimization-access?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json&tabs=defender-portal) |
62+
|**APIs** | - [Microsoft Sentinel in the Defender portal: Capability differences between portals](/azure/sentinel/microsoft-sentinel-defender-portal) <br>- [Microsoft Sentinel REST API reference](/rest/api/securityinsights/) |
6063

61-
- [When to use auxiliary logs in Microsoft Sentinel](/azure/sentinel/basic-logs-use-cases)
62-
- [Log retention plans in Microsoft Sentinel](/azure/sentinel/log-plans)
63-
- [Set up a table with the Auxiliary plan for low-cost data ingestion and retention in your Log Analytics workspace](/azure/azure-monitor/logs/create-custom-table-auxiliary)
64-
- [Microsoft Sentinel in the Defender portal: threat management](/azure/sentinel/microsoft-sentinel-defender-portal#threat-management)
64+
<!--add bookmark for API related information-->
65+
<!--add bookmarks for data connector specifics, also add content there re mdc and dlp items. that's on ed-->
66+
## Move to unified SecOps as a security analyst or manager
6567

66-
## Transition to unified SecOps as a security engineer
68+
The following content is relevant for security analysts or security managers on a SecOps team that's moving from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
6769

68-
The following content is relevant for security engineers on a SecOps team that's transitioning from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
70+
| Feature | Details |
71+
|-------------|-------------|
72+
| **Incident and alert management** |[Alert correlation and incident merging in the Microsoft Defender portal](/defender-xdr/alerts-incidents-correlation?view=o365-worldwide) <br><br> The streamlined incident triage workflow in the Defender portal may require some retraining of analysts and updates to existing SOC processes. For example, incidents may now contain multiple cross-security domain alerts, reducing the number of required analysts and potentially combining tier 1 and tier 2 analysts. |
73+
| **Attack disruption** | - [Automatic attack disruption](/defender-xdr/automatic-attack-disruption) <br> - [Details and results of an automatic attack disruption action](/defender-xdr/autoad-results) <br> - [Exclude assets from automated responses](/defender-xdr/automatic-attack-disruption-exclusions) |
74+
| **Advanced hunting** | - [Advanced hunting with Microsoft Sentinel data in Microsoft Defender](/defender-xdr/advanced-hunting-microsoft-defender) <br> - [Microsoft Sentinel in the Microsoft Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal) |
75+
| **Entities and user and entity behavior analytics (UEBA)** | - [Advanced threat detection with UEBA](/azure/sentinel/identify-threats-with-entity-behavior-analytics) <br> - [Enable UEBA](/azure/sentinel/enable-entity-behavior-analytics?tabs=defender) <br> - [Microsoft Sentinel UEBA reference](/azure/sentinel/ueba-reference) <br> - [Investigate users](/defender-xdr/investigate-users) <br> - [Device entity pages](/defender-xdr/entity-page-device) <br> - [Global search](/defender-xdr/microsoft-365-defender-portal#global-search) |
76+
| **Case management** | [Manage cases in Microsoft's unified security operations platform](/unified-secops-platform/cases-overview) |
77+
| **Security Copilot integration** | - [Summarize incidents](/microsoft-365/security/defender/security-copilot-m365d-incident-summary) <br> - [Summarize identities](/defender-xdr/security-copilot-defender-identity-summary) <br> - [Use guided response](/microsoft-365/security/defender/security-copilot-m365d-guided-response) <br> - [Analyze files](/microsoft-365/security/defender/copilot-in-defender-file-analysis) <br> - [Analyze scripts and codes](/microsoft-365/security/defender/security-copilot-m365d-script-analysis) <br> - [Create incident reports](/microsoft-365/security/defender/security-copilot-m365d-create-incident-report) <br> - [Generate KQL queries for hunting](/microsoft-365/security/defender/advanced-hunting-security-copilot) <br> - [Summarize device information](/microsoft-365/security/defender/copilot-in-defender-device-summary) |
78+
| **Threat intelligence** | Extra features are available in the Defender portal with unified SecOps, including: <br> - [Threat analytics](/defender-xdr/threat-analytics) <br> - [Intel profiles](https://techcommunity.microsoft.com/blog/defenderthreatintelligence/whats-new-intel-profiles-deliver-crucial-information-context-about-threats/3780076) <br> - [Searching and pivoting with the Intel explorer](/defender/threat-intelligence/searching-and-pivoting) <br> - [Intel projects](/defender/threat-intelligence/using-projects) <br> For more information, see [Microsoft Sentinel in the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json). |
79+
| **Visualization and reporting with workbooks** | - [Visualize and monitor your data by using workbooks with Microsoft Sentinel](/azure/sentinel/monitor-your-data?tabs=defender-portal) <br> - [Azure Workbooks](/azure/azure-monitor/visualize/workbooks-overview) <br> - [Microsoft Sentinel in the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json) |
6980

70-
- **Data collection**:
81+
<!--do we have nothing in docs about intel profiles?-->
82+
<!--add bookmark for workbooks related information-->
7183

72-
- [Microsoft Sentinel data connectors](/azure/sentinel/connect-data-sources?tabs=defender-portal)
73-
- Experience in the Defender portal:
74-
- [Visibility of connectors used by the unified security operations platform](/azure/sentinel/microsoft-sentinel-defender-portal)
75-
- [Defender for Cloud](/azure/sentinel/microsoft-sentinel-defender-portal) <!--add bookmarks for data connector specifics, also add content there re mdc and dlp items. that's on ed-->
76-
- [DLP data](/azure/sentinel/microsoft-sentinel-defender-portal) <!--add bookmarks for data connector specifics, also add content there re mdc and dlp items. that's on ed-->
77-
78-
- **Automation**: [Automation in the Microsoft Defender portal](/azure/sentinel/automation/automation#automation-in-the-microsoft-defender-portal)
79-
80-
- **Ecosystem**: Distribute content across workspaces using one of the following methods:
81-
82-
- [Deploy content as code from your repository](/azure/sentinel/ci-cd)
83-
- [Microsoft Defender multitenant management](mto-overview.md)
84-
85-
- **SOC optimization**: [Optimize your security operations](/azure/sentinel/soc-optimization/soc-optimization-access?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json&tabs=defender-portal)
86-
87-
- **APIs**
88-
89-
- [Microsoft Sentinel in the Defender portal: Capability differences between portals](/azure/sentinel/microsoft-sentinel-defender-portal) <!--add bookmark for API related information-->
90-
- [Microsoft Sentinel REST API reference](/rest/api/securityinsights/)
91-
92-
## Transition to unified SecOps as a security analyst or manager
93-
94-
The following content is relevant for security analysts or security managers on a SecOps team that's transitioning from Microsoft Sentinel in the Azure portal to unified SecOps in the Defender portal:
95-
96-
- **Incident and alert management**
97-
98-
The streamlined incident triage workflow in the Defender portal may require some retraining of analysts and updates to existing SOC processes. For example, incidents may now contain multiple cross-security domain alerts, reducing the number of required analysts and potentially combining tier 1 and tier 2 analysts.
99-
100-
- [Alert correlation and incident merging in the Microsoft Defender portal](/defender-xdr/alerts-incidents-correlation?view=o365-worldwide)
101-
102-
- **Attack disruption**:
103-
104-
- [Automatic attack disruption](/defender-xdr/automatic-attack-disruption)
105-
- [Details and results of an automatic attack disruption action](/defender-xdr/autoad-results)
106-
- [Exclude assets from automated responses](/defender-xdr/automatic-attack-disruption-exclusions)
107-
108-
- **Advanced hunting**
109-
110-
- [Advanced hunting with Microsoft Sentinel data in Microsoft Defender](/defender-xdr/advanced-hunting-microsoft-defender)
111-
- [Microsoft Sentinel in the Microsoft Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal)
112-
113-
- **Entities and user and entity behavior analytics (UEBA)**
114-
115-
- [Advanced threat detection with UEBA](/azure/sentinel/identify-threats-with-entity-behavior-analytics)
116-
- [Enable UEBA](/azure/sentinel/enable-entity-behavior-analytics?tabs=defender)
117-
- [Microsoft Sentinel UEBA reference](/azure/sentinel/ueba-reference)
118-
- [Investigate users](/defender-xdr/investigate-users)
119-
- [Device entity pages](/defender-xdr/entity-page-device)
120-
- [Global search](/defender-xdr/microsoft-365-defender-portal#global-search)
121-
122-
- **Case management**: [Manage cases in Microsoft's unified security operations platform](/unified-secops-platform/cases-overview)
123-
124-
- **Security Copilot integration**:
125-
126-
- [Summarize incidents](/microsoft-365/security/defender/security-copilot-m365d-incident-summary)
127-
- [Summarize identities](/defender-xdr/security-copilot-defender-identity-summary)
128-
- [Use guided response](/microsoft-365/security/defender/security-copilot-m365d-guided-response)
129-
- [Analyze files](/microsoft-365/security/defender/copilot-in-defender-file-analysis)
130-
- [Analyze scripts and codes](/microsoft-365/security/defender/security-copilot-m365d-script-analysis)
131-
- [Create incident reports](/microsoft-365/security/defender/security-copilot-m365d-create-incident-report)
132-
- [Generate KQL queries for hunting](/microsoft-365/security/defender/advanced-hunting-security-copilot)
133-
- [Summarize device information](/microsoft-365/security/defender/copilot-in-defender-device-summary)
134-
135-
- **Threat intelligence**: Extra features are available in the Defender portal with unified SecOps, including:
136-
137-
- [Threat analytics](/defender-xdr/threat-analytics)
138-
- [Intel profiles](https://techcommunity.microsoft.com/blog/defenderthreatintelligence/whats-new-intel-profiles-deliver-crucial-information-context-about-threats/3780076) <!--do we have nothing in docs about this?-->
139-
- [Searching and pivoting with the Intel explorer](/defender/threat-intelligence/searching-and-pivoting)
140-
- [Intel projects](/defender/threat-intelligence/using-projects)
141-
142-
For more information, see [Microsoft Sentinel in the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json).
143-
144-
- **Visualization and reporting with workbooks**:
145-
146-
- [Visualize and monitor your data by using workbooks with Microsoft Sentinel](/azure/sentinel/monitor-your-data?tabs=defender-portal)
147-
- [Azure Workbooks](/azure/azure-monitor/visualize/workbooks-overview)
148-
- [Microsoft Sentinel in the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal?toc=%2Funified-secops-platform%2Ftoc.json&bc=%2Funified-secops-platform%2Fbreadcrumb%2Ftoc.json) <!--add bookmark for workbooks related information-->
14984

15085
## Related content
15186

0 commit comments

Comments
 (0)