From 7873e78095a2afd0981c1fe8c389af48693ebcbb Mon Sep 17 00:00:00 2001
From: Robbe Van den Daele
 <107618465+RobbeVandenDaele@users.noreply.github.com>
Date: Thu, 11 Sep 2025 10:13:27 +0200
Subject: [PATCH] Add warning for Microsoft Defender XDR connector on
 offboarding

Added a warning about reconnecting the Microsoft Defender XDR connector after offboarding.
---
 unified-secops-platform/microsoft-sentinel-onboard.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/unified-secops-platform/microsoft-sentinel-onboard.md b/unified-secops-platform/microsoft-sentinel-onboard.md
index 546ea78010..1f52eb9317 100644
--- a/unified-secops-platform/microsoft-sentinel-onboard.md
+++ b/unified-secops-platform/microsoft-sentinel-onboard.md
@@ -137,7 +137,8 @@ When you switch the primary workspace for Microsoft Sentinel, the Defender XDR c
 
 If you decide to offboard a workspace from the Defender portal, disconnect the workspace from the settings for Microsoft Sentinel.
 
-If your workspace has the [Microsoft Defender XDR connector](/azure/sentinel/connect-microsoft-365-defender) configured, offboarding the workspace from the Defender portal will also disconnect the Microsoft Defender XDR connector.
+> [!WARNING]
+> If your workspace has the [Microsoft Defender XDR connector](/azure/sentinel/connect-microsoft-365-defender) configured, offboarding the workspace from the Defender portal will also disconnect the Microsoft Defender XDR connector. Make sure to reconnect the Microsoft Defender XDR connector if you want to receive Defender XDR incidents in Microsoft Sentinel again. 
 
 1. Go to the [Microsoft Defender portal](https://security.microsoft.com/) and sign in.
 1. In the Defender portal, under **System**, select **Settings** > **Microsoft Sentinel**.