Entity analyzer is now generally available
Analysis / inference: Microsoft Sentinel has reached General Availability for the entity analyzer feature, providing automated risk assessments for identities and URLs.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The entity analyzer feature within the Microsoft Sentinel Model Context Protocol (MCP) data exploration tool collection is now generally available, providing out-of-the-box explainable risk assessments for URLs and identities using threat intelligence and organizational context.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisSOC analysts and engineers utilizing Microsoft Sentinel must account for the general availability of the entity analyzer tool and prepare for incoming Security Compute Units (SCU) billing charges starting in April 2026.
SOC teams gain automated risk intelligence for identities and URLs, but must plan for Security Compute Unit (SCU) consumption charges beginning April 1, 2026.
Section 03 · Recommended actions
- Evaluate current entity analyzer usage in threat investigation workflows.
- Review Microsoft Sentinel MCP server pricing documentation to forecast future SCU consumption costs.
- Review current utilization of the entity analyzer within the Microsoft Sentinel Model Context Protocol data exploration tool collection.
- Check upcoming budget allocations for Security Compute Units (SCU) associated with entity analyzer pricing limits.