Microsoft Sentinel to Defender Portal Migration — Complete LLD and Execution Plan

What this achieves: A unified SOC platform with a single incident queue, automatic multi-stage attack correlation, cross-platform Advanced Hunting, unified entity pages, and no additional cost.

In This Article

Before You Start — Key Decisions to Lock In

Get sign-off on all of the following before touching anything technical:

Decision Item	Options	Recommended	Sign-Off Required From
Proceed with migration	Yes / No / Phased	Yes — full migration	Executive Sponsor
Migration window	Business hours / After-hours / Maintenance window	After-hours maintenance window	Change Advisory Board
Data privacy policy change	Accept Defender XDR policies / Defer	Accept — documented risk acceptance	DPO / Legal / CISO
CMK encryption scope reduction	Accept / Defer migration	Document as accepted risk	CISO / Data Owner
Primary workspace designation	One per tenant	Designate and document	Security Architect
Workspace Manager replacement	CI/CD Pipelines / Multitenant Portal	CI/CD (GitHub/Azure DevOps)	Security Architect
API migration strategy	Migrate all / Migrate incrementally	Incremental by integration priority	Security Architect + Dev Lead
IdentityInfo table-level RBAC removal	Accept loss / Design compensating control	Design compensating control first	Security Architect + IAM Lead

⚠️ CMK Notice: CMK-encrypted alerts and incidents will permanently lose CMK encryption after onboarding. Obtain written acceptance from your CISO or Data Owner before proceeding.

Phase Overview

#	Phase	Primary Audience	Estimated Duration
1	Read Official Guidance	Security Architects	1–2 Days
2	Pre-Requisites	Security Architects / Engineers	3–5 Days
3	Plan Component Migration	Security Architects	1–2 Weeks
4	Design	Security Architects / Engineers	1–2 Weeks
5	Implementation	Security Engineers	3–7 Days
6	Testing	Security Engineers / SOC Analysts	3–5 Days
7	Validation	All Roles	2–3 Days
8	Sign-Off & Completion	All Roles	Ongoing

Total estimated timeline: 4–6 weeks

Phase 1 — Read the Official Docs

Read and understand all five articles before planning anything:

Article	Purpose	Key Takeaway
Plan for unified security operations in the Defender portal	Architecture overview and role assignments	Microsoft Sentinel Contributor role auto-assigned to MTP and WDATP apps upon onboarding
Deploy for unified security operations	Step-by-step reference for new and existing customers	Use as deployment reference even for existing Sentinel customers
Connect Sentinel to the Defender portal	Onboarding prerequisites and procedure	Non-E5 customers need an extra manual step to trigger the connection
Data security and retention — Defender XDR	Defender XDR data governance policies	These policies replace Sentinel policies once the Defender portal is used
Alert schema differences: Standalone vs XDR connector	Schema changes when switching connectors	Critical for updating KQL queries, analytics rules, and workbooks

Phase 2 — Pre-Requisites (3–5 Days)

Identity & Permissions

Prerequisite	What to Check	How to Verify	Who
Subscription Owner or User Access Administrator	Onboarding user must hold one of these roles	Azure portal > Subscriptions > IAM > Check role assignments	Security Architect
Microsoft Sentinel workspace is active	Workspace must be in a healthy, active state	Azure portal > Microsoft Sentinel > Check workspace status	Security Engineer
All Sentinel users have Azure AD accounts	Users needing Defender portal access must have valid Azure AD accounts	Azure AD > Users > Verify accounts for SOC team	IAM Lead
Microsoft Threat Protection app exists in tenant	Auto-assigned Sentinel Contributor role on onboarding	Azure AD > Enterprise Applications > Search Microsoft Threat Protection	Security Engineer
WindowsDefenderATP app exists in tenant	Auto-assigned Sentinel Contributor role on onboarding	Azure AD > Enterprise Applications > Search WindowsDefenderATP	Security Engineer

Configuration Backup (Take Before Any Onboarding Step)

⚠️ This is your only reliable rollback point. Do not skip.

Component	Export Method	Storage Location
Analytics Rules	Sentinel API: GET /analyticsRules or export via Azure portal	Git repository
Automation Rules	Sentinel API: GET /automationRules	Git repository
Playbooks (Logic Apps)	Azure portal > Logic Apps > Export (ARM template)	Git repository
Workbooks	Azure portal > Sentinel > Workbooks > Export each custom workbook	Git repository
Watchlists	Azure portal > Sentinel > Watchlist > Export each list	Git repository
Threat Intelligence Indicators	Sentinel API: GET /threatIntelligence/indicators	Git repository
Hunting Queries	Azure portal > Sentinel > Hunting > Export saved queries	Git repository
Custom KQL Functions	Azure portal > Logs > Functions — document each function	Git repository

Phase 3 — Plan Your Component Migration (1–2 Weeks)

Data Connectors

Connector Category	Migration Behaviour	Action Required
Microsoft Defender XDR Connector	CRITICAL — must be active with incidents and alerts turned on	Verify connector state; schedule enablement if not active
Defender for Cloud (Tenant-based)	Risk of duplicate incidents if not handled	Plan deduplication action — document in runbook
Defender for Cloud (Subscription/Legacy)	Must opt out of incident/alert sync to Defender	Schedule opt-out step in implementation phase
Defender for Cloud Apps / Endpoint / Identity / Office 365	Hidden in Defender portal Data Connectors page post-onboarding	Inform team; confirm they remain listed in Azure portal
Third-party / Custom Connectors	Continue operating without interruption	No migration action needed; verify after onboarding

Analytics Rules

Rule Type	Migration Behaviour	Plan Action
Scheduled Analytics Rules	Fully supported in Defender portal	Inventory all rules; flag alert-only rules for review
Fusion Rule	DISABLED on onboarding — replaced by Defender XDR engine	Accept; document replacement; verify correlation post-cutover
Microsoft Incident Creation Rules	DEACTIVATED on onboarding to prevent duplicates	Accept; document; do not re-enable
Alert-Only Rules (no incident creation)	Alerts NOT visible in Defender portal incident queue	Decide per rule: enable incident creation or leave as-is
NRT (Near Real-Time) Rules	Supported in Defender portal	No action needed
Custom Detection Rules (Defender XDR)	Can now query both Defender XDR and Sentinel tables	Identify scheduled rules that could migrate to custom detections

Automation Rules — Items to Audit

Item to Check	What to Look For	Action Required
Incident Provider conditions	Rules filtering on “Microsoft Sentinel” or “Microsoft 365 Defender”	Must be updated — all incidents become provider “Microsoft XDR”
Description field conditions	Field removed from SecurityIncident table post-onboarding	Replace with Incident title, Analytic rule name, Tags, or Severity
Incident title conditions	May break if rule relied on auto-generated titles	Replace with analytic rule name + tags
Updated By conditions	“Updated by: Microsoft 365 Defender” no longer applies	Replace with “Updated by: Other”
Multi-workspace rules	Rules tied to secondary workspaces	Must transfer to the primary workspace

Playbooks — Capability Changes

Playbook Action	Supported in Defender Portal	Plan Decision
Run playbook on incident (triggered)	✅ YES	No change needed
Run playbook manually on alert	❌ NO	Document: must use Azure portal
Run playbook manually on entity	❌ NO	Document: must use Azure portal
Add alerts to / remove alerts from incidents	❌ NO	Remove these steps from any playbook; update runbooks
Access incident Description field	❌ NO (field removed)	Update Logic App steps that reference this field
Trigger latency	Up to 5 min delay	Update SLA documentation; add retry logic if needed

Risk Register

Risk	Probability	Impact	Mitigation
Duplicate incidents from Defender for Cloud connector	High if not handled	High	Plan opt-out / deduplication action before onboarding
Analytics rules querying deprecated schema fields break	Medium	High	Complete schema difference review in Phase 4
Automation rules firing on wrong incident scope	High if not updated	High	Update all incident provider conditions before go-live
Playbooks referencing removed Description field fail	Medium	Medium	Audit all playbooks; update Logic App steps
IdentityInfo table-level RBAC access control gap	Low	High	Design and implement compensating control in Phase 4
Analyst confusion during transition period	High	Medium	Mandatory training; updated runbooks
Data residency non-compliance in Defender portal	Low	Critical	DPO sign-off in Phase 2; verify regions before onboarding

Phase 4 — Design (1–2 Weeks)

Schema Differences — KQL & API Updates Required

Schema Element	Old Schema (Standalone)	New Schema (XDR Connector)	Design Action
Alert product names	alertProductNames (direct field)	Requires ?$expand=alerts on GET request	Update all API calls; update KQL referencing this field
Provider name	Azure Sentinel	Microsoft XDR	Update any filters referencing Azure Sentinel
Service source	Not present	serviceSource field available	Optional: enrich analytics rules with new field
Detection source	Not present	detectionSource field available	Optional: enrich analytics rules with new field
IdentityInfo (Advanced Hunting)	Sentinel Log Analytics fields	Unified Defender XDR + Sentinel fields — some renamed	Audit all IdentityInfo queries for renamed/removed fields

Automation Rules — Redesign Decisions

Element	Old Approach	New Approach
Incident scope	Filter by Incident Provider = Microsoft Sentinel	Use Analytic rule name as scope limiter
Description field condition	Filter on Description field content	Replace with Incident title, Analytic rule name, Tags, or Severity
Title conditions	Match on incident title	Replace with analytic rule name + tags
Updated By condition	“Updated by: Microsoft 365 Defender”	Replace with “Updated by: Other”

Playbook Redesign

Affected Playbook Action	Design Solution
Steps using incident Description field	Add a Compose step: concat(incident.title + \| Severity: + incident.severity + \| Entities: + entities list)
Steps adding/removing alerts from incidents	Remove these steps entirely
Manual alert / entity playbook runs	Keep available in Azure portal; document in SOC runbooks
Latency-sensitive playbooks (under 5-min SLA)	Design retry logic in Logic App; update SLA documentation
ServiceNow incident sync (description field)	Build description string from title + severity + alert product names via Logic App Compose step

API Integration Migration Priority

Integration Type	Current API	Target API	Priority
Incident CRUD operations	SecurityInsights API	Graph API /security/incidents	High
Alert operations	SecurityInsights API	Graph API /security/alerts_v2	High
ServiceNow incident URL field	incidentUrl (Sentinel portal)	providerIncidentUrl for Defender portal deep link	High
Advanced Hunting queries	SecurityInsights API	Graph API /security/runHuntingQuery	Medium
Analytics rule management	SecurityInsights API	Keep SecurityInsights API — fully supported	Low / No change

Phase 5 — Implementation (3–7 Days)

⚠️ Schedule onboarding during an after-hours, low-activity maintenance window. Have a secondary analyst monitoring the Azure portal for 30 minutes post-onboarding. Steps must be completed in order — Steps 1 and 2 must happen before workspace onboarding.

Step	Action	Where
1	Configure Defender for Cloud connector deduplication	Azure portal > Sentinel > Data Connectors > Tenant-based Defender for Cloud
2	Opt legacy Defender for Cloud connector out of incident/alert sync	Azure portal > Sentinel > Data Connectors > Legacy connector
3	Enable Microsoft Defender XDR connector (incidents + alerts + all Defender product sources)	Azure portal > Sentinel > Data Connectors > Microsoft Defender XDR
4	Confirm connector shows Connected; test KQL against SecurityAlert table	Azure portal > Sentinel > Logs
5	Update all playbooks — replace Description field references with Compose step	Azure portal > Logic Apps
6	Confirm maintenance window active; secondary analyst monitoring	Azure portal incident queue
7	Execute workspace onboarding (non-E5: perform additional manual connection step)	Defender portal
8	Wait 5 minutes — do not make changes during propagation	—
9	Confirm workspace shows as connected in Defender portal	Defender portal
10	Verify Sentinel incidents appear in Defender portal incident queue	Defender portal > Incidents

Playbook Description Field Compose Step:

concat(triggerBody()?['object']?['properties']?['title'], ' | Severity: ', triggerBody()?['object']?['properties']?['severity'])

Phase 6 — Testing (3–5 Days)

Data Connector Tests

Test ID	What to Test	Expected Result
DC-01	Defender XDR connector active with incidents and alerts	Status: Connected; incidents and alerts flowing
DC-02	No duplicate incidents from Defender for Cloud	Zero duplicate incidents in both portals
DC-03	Third-party connectors continue flowing	Data present and fresh within expected ingestion latency
DC-04	Hidden connectors still listed in Azure portal	Still listed and active in Azure portal
DC-05	Alert schema — alertProductNames accessible	Populated correctly via Graph API

Analytics Rules Tests

Test ID	What to Test	Expected Result
AR-01	Scheduled rules fire and create incidents	Incident appears in Defender portal incident queue
AR-02	Fusion rule is disabled	Fusion rule shows as Disabled
AR-03	Microsoft Incident Creation rules deactivated	All show as Inactive
AR-04	Alert-only rules visibility per design	Alert NOT in Defender portal queue; accessible in Advanced Hunting
AR-05	Updated KQL schema queries return expected results	Results match pre-migration baseline
AR-06	Alert tuning available for Sentinel alerts	Tune alert option available and functional

Automation Rules Tests

Test ID	What to Test	Expected Result
AUT-01	Automation rule fires on new incident	Rule executes within 10 minutes of incident creation
AUT-02	Analytic rule name condition scopes correctly	Rule fires only for the specified analytics rule incidents
AUT-03	No automation rule fires on Description field condition	Rule does not fire; no errors
AUT-04	Incident title change does not break automation	Automation fires correctly using analytic rule name condition
AUT-05	Updated by Other condition fires correctly	Rule fires correctly when incident updated by Defender XDR processes
AUT-06	Multi-workspace automation rules fire in correct workspace	Automation rules execute in the workspace they are assigned to

Playbook Tests

Test ID	What to Test	Expected Result
PB-01	Triggered playbook runs on incident from Defender portal	Playbook executes successfully within 5–10 minutes
PB-02	Composited description field populates correctly in ITSM	Description field populated with title + severity + entities
PB-03	Playbook does not fail on removed add/remove alert steps	No failed runs; Logic App execution history shows Success
PB-04	Manual playbook run confirmed in Azure portal	Executes successfully; NOT available from Defender portal
PB-05	Playbook triggering latency within SLA	All executions within updated SLA window
PB-06	Logic App version history available for rollback	Previous versions visible and restorable

Workbook Tests

Test ID	What to Test	Expected Result
WB-01	All custom workbooks load without errors in Defender portal	All workbooks load; no missing data errors
WB-02	IdentityInfo workbooks updated for new field names	Data renders correctly with no “column not found” errors
WB-03	Workbooks querying SecurityAlert table still work	Data loads correctly despite table not appearing in schema browser
WB-04	Workbook data freshness	Data within expected ingestion latency

Advanced Hunting & UEBA Tests

Test ID	What to Test	Expected Result
AH-01	All existing Sentinel KQL tables queryable in Advanced Hunting	All queries return data; no “table not found” errors
AH-02	Bookmarks migrated to Threat Management > Hunting	All pre-migration bookmarks visible and accessible
AH-03	IdentityInfo table unified field names in Advanced Hunting	Fields return data; updated queries with new field names work
AH-04	Cross-platform query (Sentinel + Defender XDR)	Query returns results from both data sources in one response
AH-05	SecurityAlert table queryable despite not in schema browser	Query executes and returns results
AH-06	UEBA entity pages load with unified context	Entity page shows combined Sentinel + Defender XDR context

Incident Queue & Correlation Tests

Test ID	What to Test	Expected Result
IQ-01	Unified incident queue shows Sentinel and Defender XDR incidents	Incidents from both sources appear in the same queue
IQ-02	Incident provider is Microsoft XDR for all incidents	All show Microsoft XDR as provider
IQ-03	Multi-stage correlated incident test	Single unified incident with alerts from multiple domains correlated
IQ-04	No Sentinel alerts from alert-only rules visible in queue	Not present in queue; access via Advanced Hunting only
IQ-05	Incident comment add/edit behaviour	Comment added successfully; editing not supported in Defender portal
IQ-06	Closed incident behaviour — new alerts create new incident	New incident created; closed incident remains closed

Phase 7 — Validation (2–3 Days)

SOC Analyst Walkthrough

Tier	Workflow Steps
Tier 1 — Triage	Log into Defender portal → Navigate incident queue → Filter by severity → Open incident → Review correlated alerts → Classify and assign
Tier 2 — Investigation	Open a medium/high severity incident → Navigate entity pages → Review UEBA context → Run Advanced Hunting query from incident → Add investigation note
Tier 3 — Response	Trigger a response playbook → Confirm playbook executes → Verify ITSM ticket created with correct data

Known Limitations — Accept and Document

Known Limitation	Workaround
Similar Incidents feature not available in Defender portal	Use Advanced Hunting to find similar incidents by entity/tactic
Incident Tasks not available	Use external ITSM task management; document task steps in incident comments
Manual playbook run on alert/entity not in Defender portal	Run from Azure portal; document in SOC runbooks
Add entity to Threat Intelligence — Azure portal only	Navigate to Azure portal for this specific action
Edit incident comments not supported	Add new comments; archive original comment content externally
Programmatic/manually created incidents not synced to Defender portal	Access via Azure portal or API; accepted as deliberate design
Table-level RBAC on IdentityInfo removed	Compensating control implemented per design in Phase 4

Phase 8 — Migration Complete Checklist

The migration is officially complete when all of the following are signed off:

Completion Gate	Sign-Off Authority	Status
All Phase 6 testing tests marked Pass	Security Engineering Lead	☐
All Phase 7 validation items confirmed	SOC Lead	☐
All success criteria marked Pass	Security Architect	☐
SOC analyst training completed	SOC Lead	☐
ITSM/ServiceNow integration confirmed	Security Engineer / ITSM Admin	☐
Risk register reviewed; residual risks accepted	CISO	☐
Post-migration review meeting scheduled within 30 days	Project Lead	☐
Azure portal decommission plan agreed (if applicable)	Security Architect + CISO	☐

Source: learn.microsoft.com/en-us/azure/sentinel/move-to-defender | Document by Surya PS, CISSP | sunexplains.com

claude-publish

Microsoft Sentinel to Defender Portal Migration — Complete LLD and Execution Plan

Before You Start — Key Decisions to Lock In

Phase Overview

Phase 1 — Read the Official Docs

Phase 2 — Pre-Requisites (3–5 Days)

Identity & Permissions

Configuration Backup (Take Before Any Onboarding Step)

Phase 3 — Plan Your Component Migration (1–2 Weeks)

Data Connectors

Analytics Rules

Automation Rules — Items to Audit

Playbooks — Capability Changes

Risk Register

Phase 4 — Design (1–2 Weeks)

Schema Differences — KQL & API Updates Required

Automation Rules — Redesign Decisions

Playbook Redesign

API Integration Migration Priority

Phase 5 — Implementation (3–7 Days)

Phase 6 — Testing (3–5 Days)

Data Connector Tests

Analytics Rules Tests

Automation Rules Tests

Playbook Tests

Workbook Tests

Advanced Hunting & UEBA Tests

Incident Queue & Correlation Tests

Phase 7 — Validation (2–3 Days)

SOC Analyst Walkthrough

Known Limitations — Accept and Document

Phase 8 — Migration Complete Checklist

Comments

Leave a Reply Cancel reply

More posts

XDR

Microsoft Sentinel to Defender Portal Migration — Complete LLD and Execution Plan

CISSP Study Guide (2026): Complete Roadmap for All 8 Domains

Microsoft Sentinel Guide: Complete Operations & Deployment (2026)