Microsoft Sentinel

Microsoft Sentinel is a cloud SIEM whose SOAR is automation rules plus Azure Logic Apps playbooks, billed on top of Sentinel. After 2027-03-31 it is supported only in the Defender portal, and Microsoft documents delays in how automation runs there. Playbooks export as ARM JSON, and Microsoft publishes a concept map from Splunk SOAR.

What it is

Microsoft Sentinel is a SIEM built on Azure Monitor Log Analytics workspaces. Automation rules trigger when an incident is created, an incident is updated or an alert is created. Built-in actions cover tasks, status, severity, owner, tags and closing with a reason, and a rule can call a playbook. Rules run in order by number. Playbooks are Azure Logic Apps workflows, Consumption or Standard, and Logic Apps charges apply on top of Sentinel charges. Pay-as-you-go analytics is USD 4.30 per GB analysed at the page default region (Microsoft pricing page, read 2026-11-03).

The playbook artefact is an Azure Logic Apps workflow. A playbook template is an ARM template holding the workflow and its API connections. The Code view in the Logic Apps editor exposes the ARM JSON, a PowerShell script in the Azure-Sentinel GitHub repository exports a sanitised template, and Deploy to Azure buttons install templates from the repository playbooks folder. Automation rules also export as ARM JSON for CI/CD (Microsoft Learn, read 2026-11-03). No importer from another SOAR is documented. Microsoft's Splunk SOAR guide is a concept map to automation rules and Logic Apps and names no converter tool.

The vendor describes itself this way: Microsoft Sentinel is a cloud SIEM built on Azure Monitor Log Analytics workspaces. It runs analytics rules, KQL hunting, automation rules that can call Azure Logic Apps playbooks, and a data lake tier for long-term security data. microsoft.com, read 2026-11-03

How Microsoft Sentinel scores

Nine rows, weights summing to 100, each scored 0 to 10 from pages read on 2026-11-03. The part is score times weight divided by 100. How the scoring works.

Where Microsoft Sentinel is strong

• Playbooks are Logic Apps built in the visual designer, with Azure Functions for code, conditional controls and ARM template export for portability. Authoring scores 8.5. learn.microsoft.com, read 2026-11-03
• Prices are published: USD 4.30 per GB analysed on pay-as-you-go, and commitment tiers from USD 296 per day at 100 GB a day, at the page default region. Logic Apps adds its own charges. microsoft.com, read 2026-11-03
• Microsoft publishes a concept map from Splunk SOAR and QRadar SOAR to automation rules and Logic Apps, updated on 2026-08-12. It names no converter tool. learn.microsoft.com, read 2026-11-03

Where Microsoft Sentinel is behind

• After 2027-03-31 Sentinel is supported only in the Microsoft Defender portal, and Azure portal users are redirected. Microsoft lists automation differences in Defender that a team must test before the date. learn.microsoft.com, read 2026-11-03
• No AI features for automation were found on the pages read, and Security Copilot was not read. Documented AI scores 4.0 and is flagged for a re-read. learn.microsoft.com, read 2026-11-03
• Approval is built by the author and is not a built-in gate. Microsoft says high-impact automations should have human input and maps Splunk prompts to a Send approval email action. learn.microsoft.com, read 2026-11-03

A fact only Microsoft Sentinel has

Microsoft documents that in the Defender portal incident updates are batched for five to ten minutes, automation rules can take up to ten minutes to run, and playbook manual runs are not yet supported. learn.microsoft.com, read 2026-11-03

Pricing as published

Analytics tier: pay-as-you-go per GB analysed, or commitment tiers that reserve daily ingestion (100 GB to 50,000 GB per day). Data lake tier: per GB ingested, processed, queried and stored, with separate compute meters. Playbooks add Azure Logic Apps charges. Prices are USD estimates on the pricing page, region selector present, values shown at the page's default region. microsoft.com, read 2026-11-03 (vendor claim)

Ownership and funding

Microsoft Sentinel is a Microsoft product. Azure portal support ends after 2027-03-31; from then it runs only in the Microsoft Defender portal. learn.microsoft.com, read 2026-11-03 (vendor claim)

Claims Microsoft Sentinel makes about itself

These are vendor claims. They are not scored. Each carries an evidence grade: C means a vendor figure with no published method.

What the public pages did not say

• Detection-as-code via the Sentinel repositories feature not confirmed: learn.microsoft.com repositories pages returned 404 on three paths in this pass, so GitHub and Azure DevOps deployment mechanics are not recorded from a primary source
• Per-GB pricing shown is the pricing page default region; other regions not read
• No named Sentinel customers published on a vendor page read in this pass
• No accuracy, MTTR or auto-closure claim with method found on the pages read
• No analyst placement (Gartner, Forrester, IDC) read from a primary source in this pass; web search budget was exhausted during the run
• No Microsoft Sentinel newsroom or changelog entries dated 2025-11-01 or later retrieved (Microsoft Security blog not read)

Gaps recorded on 3 November 2026. A gap is an absence on the pages read, and it is scored that way.

Who should shortlist Microsoft Sentinel

• You already run Sentinel and Defender and want automation inside the Microsoft stack with Logic Apps connectors.
• You can plan the Defender portal move before 2027-03-31 and test automation timing in it.
• Your team treats playbooks as ARM templates in source control and deploys them by pipeline.

Verdict. Microsoft Sentinel is seventh of 14 scored at 6.21, in a band with Tines (6.42), Mate Security (6.22), Palo Alto Cortex XSOAR (6.18) and Swimlane (6.14); it is the natural pick inside a Microsoft estate, with AI, hosting and pricing flagged for a re-read.

Moving playbooks out of Microsoft Sentinel

Microsoft Sentinel is a source row in the portability matrix: 0 of 70 cells have a documented path. Source format: Logic Apps ARM JSON (learn.microsoft.com, read 2026-11-03). The switching guide is Leaving Microsoft Sentinel.

Microsoft Sentinel against the other eleven

• BlinkOps v Microsoft Sentinel
• Cyware v Microsoft Sentinel
• D3 Security v Microsoft Sentinel
• Google Security Operations v Microsoft Sentinel
• Mate Security v Microsoft Sentinel
• Microsoft Sentinel v Palo Alto Cortex XSOAR
• Microsoft Sentinel v ServiceNow Security Operations
• Microsoft Sentinel v Splunk SOAR (Cisco)
• Microsoft Sentinel v Swimlane (Turbine)
• Microsoft Sentinel v Tines
• Microsoft Sentinel v Torq

Alternatives to Microsoft Sentinel, ordered by the rubric.