Leaving Microsoft Sentinel

Sentinel automation exports as ARM JSON, but no page read documents a path out to another platform, and none of its 70 matrix cells carries one. After 2027-03-31 Sentinel is supported only in the Defender portal, so a team that stays on Microsoft still has a move to plan.

What moves

• Enrichment lookups, phishing triage, endpoint containment and identity actions: rebuild from scratch into every target. Mate Security claims translation but names no source or format.
• Custom scripted logic: rebuild from scratch into every target, Mate included.
• Ticketing and case sync: rebuild from scratch into every target, because no page covers it.
• Scheduled or batch jobs: rebuild from scratch into every target.
• The artefact is an Azure Logic Apps workflow. A playbook template is an ARM template with the workflow and its API connections, and automation rules export as ARM JSON for CI/CD. No other platform documents reading that JSON.

What breaks

• Tenant details. Microsoft advises removing tenant and subscription details from exported ARM JSON, and a PowerShell script in the Azure-Sentinel repository exports a sanitised template.
• API connections. A template holds the workflow and its API connections, so plan to re-authorise each connection in the target.
• Azure Functions code. Code called from a playbook lives outside the workflow JSON.
• Automation rule order. Rules run in order by number, and incident-trigger playbooks run only from incident-trigger rules, so the sequencing has to be rebuilt.
• Defender portal timing. In Defender, incident updates batch for five to ten minutes, rules can take up to ten minutes to run and manual runs of playbooks are not yet supported.
• Billing. Logic Apps charges apply on top of Sentinel charges, so a parallel run pays for both.

Where to go from Microsoft Sentinel

• Torq. Torq documents case management and a YAML workflow, and names no Sentinel importer. Plan a rebuild with the ARM JSON as the specification. Microsoft Sentinel v Torq
• Tines. Tines reaches any API over HTTP, which suits rebuilding Logic Apps connector calls, and publishes a free edition for a proof of concept. Microsoft Sentinel v Tines
• D3 Security. D3 Security lists Microsoft Sentinel among its integrations, a vendor claim, but does not name Sentinel as a migration source. D3 Security v Microsoft Sentinel
• ServiceNow Security Operations. ServiceNow documents that Sentinel ingestion and sync continue to work in the Defender portal, which suits a team that keeps Sentinel as its SIEM and moves cases to ServiceNow. Microsoft Sentinel v ServiceNow Security Operations

The documented paths, with their sources

• Automate threat response with playbooks in Microsoft Sentinel: Logic Apps playbooks, ARM templates, GitHub templates and roles. Page dated 2026-06-12. Does not cover importing from other SOARs. learn.microsoft.com, read 2026-11-03
• Playbook creation guidance for ISVs: the Code view in the Logic Apps editor exposes the ARM JSON, and a script in the Azure-Sentinel repository exports a sanitised template. Read through a search summary. learn.microsoft.com, read 2026-11-03
• Portal retirement: after 2027-03-31 Sentinel is supported only in the Microsoft Defender portal and Azure portal users are redirected. learn.microsoft.com, read 2026-11-03
• Concept map from Splunk SOAR and QRadar SOAR to Sentinel automation, updated 2026-08-12. It is written for the opposite direction, and shows which Logic Apps constructs stand in for prompts and tasks. learn.microsoft.com, read 2026-11-03

A parallel run you can audit

Run the old and the new system on the same alerts until the new one matches. Keep a parity report, a rollback path and exit criteria written down before the switch. The checklist is the corner's list for this move.

• Export every playbook and automation rule as ARM JSON and store it in source control before the portal move.
• List the API connections and Azure Functions each playbook depends on.
• Test incident updates and rule timing in the Defender portal, since Microsoft documents delays there.
• Record which playbooks run manually, because manual runs are not yet supported in Defender.
• Ask each candidate whether it reads ARM JSON at all, and in what form.
• Estimate your Logic Apps charges per playbook so a cost comparison is fair.
• Plan the cutover before 2027-03-31 and keep rollback until parity holds.