Skip to content
← Back to the guide

Microsoft Sentinel onboarding

8slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 8

Microsoft Sentinel onboarding

How to onboard Microsoft Sentinel — workspace setup, data connectors, and starting analytic rules.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 8
01

Prerequisites

Before starting:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 8
02

Connecting data sources

Sentinel's value comes from the data it ingests. Connect sources in priority order:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 8
03

Initial analytic rules

Sentinel ships hundreds of analytic rules in the content hub. For initial deployment:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 4Download PNG
M
solvingmicrosoft365.com
5 / 8
04

Workbooks and dashboards

Sentinel workbooks are interactive dashboards. The content hub provides pre-built workbooks for:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 5Download PNG
M
solvingmicrosoft365.com
6 / 8
05

Playbooks (SOAR)

Sentinel playbooks are Logic Apps that automate responses. Pre-built playbooks include:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 6Download PNG
M
solvingmicrosoft365.com
7 / 8
06

Cost management

Sentinel bills by ingested GB per day:

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 7Download PNG
M
solvingmicrosoft365.com
8 / 8
07

Unified Defender + Sentinel portal

Sentinel now integrates into the Defender XDR portal at security.microsoft.com. Analysts work in a unified surface — Defender's first-party signals plus Sentinel's broader telemetry — without switching consoles. Same KQ…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-sentinel-onboarding

Slide 8Download PNG

Auto-generated from Microsoft Sentinel onboarding. This page is not indexed and isn't part of the guide itself.