One SOC, one portal
Mar 11th, 2026 by Jesper Kråkhede
Microsoft has announced that Sentinel is moving fully into the Defender portal, and that the Azure portal experience will be retired. For many SOCs, that is a bigger change than it sounds.
For years, many SOC teams have worked in two places. Defender for the endpoint, identity, email and cloud app incidents, and Sentinel in the Azure portal for everything else: firewalls, servers, third party sources and custom detections. Two incident queues, two ways of hunting, and analysts switching between them all day.
In the unified portal, incidents from the SIEM and the XDR are correlated into one queue. Advanced hunting can query both. Automatic attack disruption can use signals from both. And, importantly for this year´s topic, AI agents get one place with all the context.
What should you do? Plan the move now, not in the last month. Onboard your Sentinel workspaces to the Defender portal and run both in parallel for a while. Review your analytics rules and automation, some of them will behave differently when incidents are correlated. Check permissions, because the role model in the Defender portal isn´t the same as in Azure. Update your runbooks and train the analysts.
There is also a compliance angle. One incident queue gives you one audit trail of what was detected, who handled it and what was done. Many organisations have struggled to give that evidence when two tools gave two different pictures.
One queue, one story, one place to look.