Sentinel leaves the Azure portal on 2027-03-31, with automation differences listed

Microsoft's automation documentation, read on 2026-11-03, says that after 2027-03-31 Sentinel is supported only in the Microsoft Defender portal, and Azure portal users are redirected. The page lists differences in Defender: incident updates are batched for five to ten minutes, automation rules can take up to ten minutes to run, and manual runs of playbooks are not yet supported. The page shows an update date of 2026-06-28, outside the window, so this note is dated the day we read it.

As of 2026-11-03 that leaves 148 days. Any playbook that depends on instant incident updates or a manual run needs a test in Defender before the date. We have not tested these behaviours, and the list is Microsoft's.

Source: learn.microsoft.com, read 2026-11-03.

What it changes for a buyer

Sentinel owners have a dated project. Test timing-sensitive automation in Defender now, and decide whether a second automation product is worth the cost.

Other dispatches

• Mate Labs publishes the Blue City benchmark, without Mate in it, 3 November 2026
• XSOAR 8.11 reaches end-of-life on 2026-11-13, 3 November 2026
• ThreatConnect's domain now redirects to Dataminr, 3 November 2026
• Google updates its SecOps playbooks screen documentation, 28 October 2026
• Torq says IDC named it a Leader in its AI SOC MarketScape, 20 October 2026
• Mate publishes CPR, its gate for autonomous actions, 18 October 2026
• Google SecOps curated rules move to the GTI_IOC feed, 12 October 2026
• Splunk SOAR 8.7.0 drops Python 3.9 and adds a connector agent, 2 September 2026
• Mate Gamebooks reach general availability, 26 August 2026
• Microsoft updates its Splunk SOAR to Sentinel migration guide, 12 August 2026
• ServiceNow press report puts a Tier 2 SOC AI Specialist in December, 5 August 2026

More notes in Dispatches. To see the platforms side by side, start from the card.