Sentinel 101: Move to the Defender Portal Before March 2027

After March 31, 2027, Microsoft Sentinel is no longer supported in the Azure portal. It moves to the Microsoft Defender portal. If you have a plain Log Analytics workspace and have been meaning to turn on Sentinel, now is the time to do it the way it will work going forward. In this walkthrough, we take the Log Analytics workspace from my previous video, the one already collecting Entra ID sign-in logs, and turn it into a Microsoft Sentinel workspace. No data moves and nothing is re-ingested. Then we connect it to the Defender portal and set it up properly. What you'll learn: 🛡️ What actually changes when Sentinel sits on top of a Log Analytics workspace 🛡️ Sentinel pricing: the 31-day free trial, pay-as-you-go vs. commitment tiers, and claiming your 90 days of free retention 🛡️ How to enable Sentinel on an existing workspace in the Azure portal 🛡️ How to connect the workspace to the Microsoft Defender portal, plus the permissions you need 🛡️ How to validate the Microsoft Entra ID data connector 🛡️ Sentinel RBAC: Reader vs. Responder vs. Contributor, and where to assign them ⏱️ Chapters 0:00 The March 2027 deadline 1:50 Sentinel vs. Log Analytics: what changes 3:46 Pricing, free trial, and retention 6:08 Enabling Sentinel in the Azure portal 9:12 Connecting to the Defender portal 11:39 Validating the Entra ID data connector 14:24 Sentinel roles and RBAC 17:25 Recap and next steps 📺 Previous video (build the workspace first):    • Exporting Sign-In Data to a Log Analytics ...   📚 Microsoft Learn references Sentinel pricing and billing: https://learn.microsoft.com/azure/sen... Roles and permissions in Sentinel: https://learn.microsoft.com/azure/sen... 🏰 Guardians of Kings Landing Blog: https://guardians-of-kings-landing.gh... Retirement date and pricing details are current as of recording. Microsoft has moved the Sentinel date once already, so check the links above for the latest. #MicrosoftSentinel #MicrosoftDefender #Azure #SIEM #EntraID #Cybersecurity #MicrosoftSecurity