Integrated Microsoft Sentinel SIEM and data lake onboarding
Analysis / inference: Microsoft Sentinel now integrates data lake onboarding directly into the standard SIEM setup workflow, eliminating separate billing configurations.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Data lake onboarding is now fully unified with Microsoft Sentinel setup, allowing long-term retention tiers to be enabled via Table management in the Defender portal after standard workspace connection.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisSimplifies data lake tier provisioning by bundling data lake capabilities directly into Microsoft Sentinel onboarding without requiring separate storage billing setup.
Reduces administrative overhead for provisioning long-term storage tiers by removing isolated data lake onboarding and standalone billing configuration steps.
Section 03 · Recommended actions
- Complete standard Microsoft Sentinel workspace onboarding.
- Verify workspace connectivity to the Microsoft Defender portal.
- Use Table management within the Defender portal to enable the lake tier for extended retention tables.
- Verify that your Microsoft Sentinel workspace is properly connected to the Defender portal.
- Review Table management settings in the Defender portal to extend retention on required data tables.