Sentinel repositories doc: custom detection rules as code in preview
The Microsoft Learn page for Sentinel repository content was updated on 2026-08-08. It covers custom detection rules as code, in preview, alongside analytics rules and automation, with smart deployments and a limit of five connections per workspace (Microsoft Learn, read 2026-11-04).
The same docs set says Azure portal support for Sentinel ends after 2027-03-31, after which it runs only in the Defender portal (vendor claim, Microsoft Learn, read 2026-11-04). A repository workflow built now will end up running against the Defender portal.
Source: learn.microsoft.com read 2026-11-04
What it changes for a buyer
Plan the repository around the Defender portal's custom detection rules, and treat the preview as subject to change before you move rules over.
All notes are in the changelog. Spotted something wrong? See corrections.