Enable the data lake tier using Table management
Analysis / inference: Microsoft Sentinel now supports enabling the data lake tier and lake-only retention directly from the Table Management page in the Defender portal.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Sentinel - What's new · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
Administrators can now select tables within the Microsoft Defender portal's Table Management page to mirror Analytics data to the Data Lake tier and configure lake-only retention for historical records.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisEnabling the data lake tier allows security analysts to query historical log data directly using Advanced Hunting without needing a costly or time-consuming restoration step back into the Analytics tier.
Streamlines long-term investigations by enabling direct queries on historical data via Advanced Hunting, replacing older archive-based retention workflows upon full Sentinel onboarding.
Section 03 · Recommended actions
- Onboard to Microsoft Sentinel in the Defender portal if not already completed
- Navigate to the Table Management page to review and configure retention settings for individual tables
- Enable data lake mirroring or lake-only retention to retain historical data cost-effectively
- Verify your current Microsoft Sentinel onboarding status in the Defender portal
- Check table-level retention settings under Table Management to confirm lake tier mirroring and lake-only retention configuration