Microsoft Sentinel is no longer just a SIEM. In 2025, Microsoft repositioned it as a cloud-native SIEM and unified security platform for agentic defense — a data-first foundation that powers AI agents, a security graph, and a hosted Model Context Protocol (MCP) server, all in the Microsoft Defender portal. That changes how you install it, where you install it, and what you can do with it on day one.
This guide walks federal agencies, Defense Industrial Base (DIB) contractors, FedRAMP cloud service providers, and regulated commercial teams through a 2026-ready Microsoft Sentinel installation — from licensing and workspace design through Defender portal onboarding, data lake activation, and Security Copilot agent integration. It is written for security architects and SOC leaders who need an installation path that survives the March 2027 Azure portal retirement and inherits the controls required by CMMC, FedRAMP, FISMA, and DoD Impact Levels 4–5.
Three official Microsoft commitments define the modern install path, and together they reshape what a Microsoft Sentinel deployment looks like in 2026:
Microsoft’s own product documentation now describes Sentinel as an AI-ready platform that “transforms telemetry into a security graph, standardizes access for agents, and coordinates autonomous actions, while keeping humans in command of strategy and high-impact investigations.” In practice, that means a 2026 Sentinel install is no longer just “turn on a SIEM” — it’s deploying a SIEM, a data lake, a security graph, and an agentic toolchain in one motion.
| Pillar | What it does | Why it matters for your install |
|---|---|---|
| Microsoft Sentinel SIEM | Cloud-native SIEM with 350+ connectors, analytics rules, automation, attack disruption | The detection and response core — install this first in the Defender portal |
| Microsoft Sentinel data lake | Open-format Parquet lake, two-tier storage (Analytics + Lake), up to 12 years retention | Activate during onboarding; eliminates the cost-vs-coverage tradeoff that crippled legacy SIEMs |
| Microsoft Sentinel graph | Unified graph analytics modeling users, devices, assets, data flows, attacker actions | Enables agents and analysts to reason over relationships, not just rows of logs |
| Microsoft Sentinel MCP server | Hosted Model Context Protocol server that lets AI clients query Sentinel data in natural language | The agentic interface — turns Sentinel into a tool an AI agent can actually use |
Before you create your first Log Analytics workspace, anchor your project plan to these three Microsoft-published dates. Skipping any of them today creates rework before March 2027.
For federal and DIB readers, there is a fourth date worth tracking: the CMMC Final Rule phase-in beginning Phase 1 on November 10, 2025, with increasing requirements over the following 36 months. A FedRAMP-High-Authorized Sentinel-based MDR — like Quzara Cybertorch™ — gives prime contractors and subcontractors a way to inherit the SC, SI, AU, and IR control families instead of building them from scratch.
A clean Sentinel install starts before you click Create. Microsoft’s prerequisites for deployment are explicit, and the design decisions you lock in here are hard to reverse later.
Microsoft’s guidance is to assign roles at the resource-group level for least-privileged access, and to use custom roles where you need finer separation. For Defender-portal Sentinel, role assignments increasingly flow through Microsoft Defender XDR Unified RBAC — including data lake permissions, which were brought under Unified RBAC in July 2025.
Sentinel runs on a Log Analytics workspace, and Microsoft now allows you to onboard unlimited workspaces to the Defender portal (with the caveat that one workspace serves as the primary per tenant). Key design rules:
Where you install Sentinel is as important as how. Microsoft Sentinel runs on Azure (commercial) and Azure Government, with feature parity that has been steadily improving but is not yet identical. The table below summarizes the practical decision:
| Environment | Compliance posture | Use for |
|---|---|---|
| Azure Commercial | SOC 2, ISO 27001, FedRAMP Moderate (for Microsoft 365 / Azure Commercial) | Regulated commercial workloads, mid-market, non-CUI environments |
| Azure Government (GCC) | FedRAMP Moderate-aligned, U.S. data residency | Federal civilian agencies, SLED, contractors not handling CUI/ITAR |
| Azure Government (GCC High) | FedRAMP High, DFARS, ITAR/EAR alignment, CUI | DIB primes and subs handling CUI; CMMC L2 environments |
| Azure Government (DoD) | DoD Impact Level 5 / 6 | DoD agencies and mission partners |
If you are deploying Sentinel for CMMC L2 or DoD IL-4/IL-5 workloads, this decision is the single most consequential one in your install plan. Quzara Cybertorch™ runs natively on Azure Government and operates entirely with U.S.-citizen analysts, which preserves ITAR posture for customers who would otherwise have to engineer it themselves.
This is the modern, supported install path. If you are deploying net-new in 2026, do not start in the Azure portal — start here.
security.microsoft.com.Microsoft removed the previous cap on how many workspaces you can onboard to the Defender portal. For enterprises and MSSPs, that means you can centralize multitenant SOC operations behind a single Defender portal experience without artificially fragmenting workspaces.
AzureActivity | take 10 to confirm data is landing.You now have a functional Sentinel deployment in the Defender portal. The next two sections — data lake and agentic Copilot — are where a 2026 Microsoft Sentinel install delivers value beyond a traditional SIEM.
The Sentinel data lake is the architectural shift that ends the historical SIEM tradeoff between cost and coverage. Instead of forcing you to pick which logs are worth ingesting at hot-tier prices, Sentinel now mirrors every Analytics-tier ingest into the data lake automatically, in open-format Parquet, and lets you keep that data for up to 12 years.
| Tier | Designed for | Engines |
|---|---|---|
| Analytics tier | Real-time detection, alerting, incidents, dashboards | KQL, scheduled analytics rules, near-real-time rules |
| Data lake tier | Long-term retention, deep forensics, ML, agentic queries | KQL exploration, Jupyter notebooks (Python), Security Copilot, Sentinel MCP server |
For Quzara customers, the data lake also unlocks a quieter benefit: it makes long-retention NIST SP 800-53 Rev 5 AU-family evidence cheap to keep. That maps directly to NISTCompliance.AI’s auditor co-pilot, which can pull from that evidence pool when generating SSP and POA&M artifacts.
The agentic layer is where a 2026 Microsoft Sentinel install separates itself from everything that came before. As of November 18, 2025, Microsoft Security Copilot is included for all Microsoft 365 E5 and E7 customers — no separate license required — and it ships with 12 new Microsoft-built agents and access to 30+ partner-built agents in the Microsoft Security Store.
When you open an incident in Sentinel in the Defender portal, Security Copilot is embedded directly into the experience. Out of the box it gives you:
The Sentinel MCP server is Microsoft’s hosted Model Context Protocol server — a unified, no-infrastructure interface that lets compatible AI clients reason over Sentinel data lake content using natural language. Supported clients include Microsoft Security Copilot, Microsoft Copilot Studio, Microsoft Foundry, Visual Studio Code (with GitHub Copilot agent mode), ChatGPT, and Claude.
The MCP server is organized into scenario-focused tool collections. The ones to know:
| Tool collection | What an agent can do with it |
|---|---|
| Data exploration | Search tables, retrieve rows, query the data lake in natural language — no schema knowledge required |
| Entity analyzer | AI-driven risk verdicts for users, URLs, and domains by reasoning over auth patterns, behavior, and threat intel |
| Triage | Fetch incidents, alerts, evidence, and entities; run advanced hunting queries through prompts |
| Agent creation | Build Security Copilot agents in natural language from VS Code — collapses weeks of playbook engineering into hours |
| Custom MCP tools | Save your own KQL queries as deterministic MCP tools so agents can call them like APIs |
https://sentinel.microsoft.com/mcp/data-exploration for the data exploration collection).The takeaway for federal and DIB SOC leaders: an agentic SOC is no longer a vendor pitch deck. It’s an out-of-the-box experience inside the Defender portal you just stood up. The strategic question is not whether to use it — it’s which agents you trust to act, and which you keep in advisory mode.
Use the Content hub to install solution-packaged rules for every connector you enable. Microsoft’s solution model has matured to the point where rolling your own from scratch is rarely the right starting move — install the solution, enable the templates, and tune from there.
Sentinel automation rules can trigger playbooks (Azure Logic Apps), assign incidents, change severity, or call agents. Common day-1 automations:
Use the Advanced hunting experience for active investigations and the data lake KQL exploration for long-horizon hunts (months or years of historical data). For unstructured hunts, lean on the MCP data-exploration collection so analysts can interrogate the lake without remembering table names. Microsoft has also added AI MITRE ATT&CK tagging recommendations in SOC optimization to suggest tactics and techniques for your existing detections.
If your install is for a federal agency, DIB contractor, or a FedRAMP cloud service provider, the install path is the same — but the cloud, the connectors, the analysts, and the inheritance story are very different.
Sentinel feature availability varies across Azure Commercial, Azure Government (GCC), Azure Government (GCC High), and Azure Government (DoD). Most core SIEM and SOAR capability is GA across all four, but specific connectors lag. Before you commit to a cloud:
For a prime contractor pursuing CMMC L2, building a Sentinel install in-house solves the tooling problem but leaves you with the staffing, 24/7 monitoring, and continuous-monitoring evidence problem. Quzara Cybertorch™ is a FedRAMP High Authorized, Azure Government-native managed detection and response service that lets your enterprise inherit the relevant SC, SI, AU, IR, and CA control families instead of standing them up yourself. That’s the difference between “we deployed Sentinel” and “we deployed Sentinel and we have an auditable, US-citizen-staffed 24/7 SOC behind it.”
A clean Microsoft Sentinel installation is necessary but not sufficient for federal and DIB security operations. You still need 24/7 monitoring, US-citizen analysts, audit-grade evidence collection, FedRAMP and CMMC alignment, and the operational discipline to keep all of it running through audits, contract changes, and threat surges.
Quzara Cybertorch™ is a FedRAMP High Authorized Managed Detection and Response (MDR) and SOC-as-a-Service built natively on Azure Government and Microsoft Sentinel. Cybertorch gives you:
If you are installing Sentinel as part of a CMMC L2, FedRAMP, or FISMA effort, the most efficient path is to deploy the platform once with Cybertorch as your MDR layer from day one — so your install plan and your audit plan move forward together.
Microsoft Sentinel in the Azure portal will no longer be supported after March 31, 2027. Starting in July 2026, remaining Azure-portal users will be automatically redirected to the Microsoft Defender portal at security.microsoft.com.
No. As of 2025, Microsoft Sentinel is generally available in the Defender portal for all customers, with or without Microsoft Defender XDR or an E5 license. You can use Sentinel in the Defender portal even if you aren’t using other Microsoft Defender services.
The Microsoft Sentinel data lake is a fully managed, Parquet-format security data lake that mirrors your Analytics-tier data, supports up to 12 years of retention, and serves as the substrate for Security Copilot agents and the Sentinel MCP server. It’s technically optional, but skipping it forfeits agentic tooling and the long-retention story that compliance frameworks like FedRAMP, FISMA, and CMMC reward.
Yes. Starting November 18, 2025, Microsoft Security Copilot is included for all Microsoft 365 E5 and E7 customers in a phased rollout. The rollout includes 12 new Microsoft-built agents and access to the Microsoft Security Store of partner-built agents.
Yes. Sentinel is available in Azure Government, including GCC, GCC High, and DoD clouds, supporting FedRAMP High, DFARS, ITAR, and DoD Impact Level 4–5 workloads. Connector availability varies by environment — check Microsoft’s feature availability matrix before committing.
The Microsoft Sentinel MCP server is a hosted Model Context Protocol server that lets AI clients — Security Copilot, Copilot Studio, Foundry, Visual Studio Code, ChatGPT, Claude — interact with Sentinel data lake content using natural language. It exposes scenario-focused tool collections for data exploration, entity analysis, triage, agent creation, and custom KQL-as-tools.
Quzara Cybertorch™ deploys Microsoft Sentinel and runs the 24/7 SOC behind it for federal agencies, DIB primes and subs, and FedRAMP cloud service providers. We’re a Microsoft Intelligent Security Association (MISA) member, FedRAMP High Authorized, Azure Government-native, and U.S.-citizen staffed — built specifically for the missions that can’t afford to get this wrong.
Schedule a Cybertorch™ briefing to map a Sentinel deployment plan against your CMMC, FedRAMP, or FISMA timeline. For AI-powered NIST, FedRAMP, and CMMC compliance automation that feeds directly off your Sentinel evidence, see NISTCompliance.AI.