Cloud Renames Contribute
RenamedCompute, Security & InfraAzure

Azure Sentinel Microsoft Sentinel

Cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platform for multi-cloud threat detection, investigation, and hunting.

Open in interactive timeline ↗All Azure renamesHome

Naming timeline

  1. Azure Sentinel

    · General Availability

    Launched in preview in February 2019 and reached general availability in September 2019 as a cloud-native SIEM/SOAR built on Azure Monitor Log Analytics.

  2. Microsoft SentinelCurrent name

    · Ignite 2021 Rebrand

    Renamed from Azure Sentinel to Microsoft Sentinel and subsequently integrated into the unified Microsoft Defender portal.

What is Azure Sentinel called now?

Azure Sentinel is now called Microsoft Sentinel, with the latest change on 2 November 2021 (Ignite 2021 Rebrand). Cloud-native security information and event management (SIEM) and security orchestration, automation, and response (SOAR) platform for multi-cloud threat detection, investigation, and hunting. Only the customer-facing name changed; the underlying technical identifiers remain backward compatible.

Also known as

  • Microsoft Sentinel SIEM

Technical identifiers

Technical identifiers unchanged. Only the customer-facing product name changed; the APIs, CLI commands, IAM roles and Terraform resources below keep their legacy identifiers for backward compatibility.

ARM Resource Providers (Microsoft.*)Microsoft.SecurityInsights Microsoft.OperationalInsights/workspaces
Azure CLI (az) / PowerShellaz sentinel Az.SecurityInsights PowerShell
Entra ID / Azure RBAC RolesMicrosoft Sentinel Contributor Microsoft Sentinel Responder Microsoft Sentinel Reader Microsoft Sentinel Playbook Operator
Terraform Resources (azurerm_*)azurerm_sentinel_log_analytics_workspace_onboarding azurerm_sentinel_alert_rule_scheduled azurerm_sentinel_data_connector_azure_active_directory azurerm_sentinel_automation_rule

ARM Resource Providers (Microsoft.SecurityInsights and Microsoft.OperationalInsights/workspaces), CLI (az sentinel), and Terraform (azurerm_sentinel_*) remain unchanged.

Notes & disambiguation

  • Introduced in public preview in February 2019 (reaching general availability in September 2019) as Azure Sentinel, and renamed to Microsoft Sentinel at Microsoft Ignite on November 2, 2021 to reflect its multi-cloud and hybrid SIEM/SOAR scope.
  • Subsequently unified with Microsoft Defender XDR in the Microsoft Defender portal (security.microsoft.com), with new customers onboarding directly to the Defender portal starting in July 2025 and an integrated Sentinel data lake tier.
  • Underlying ARM Resource Providers (Microsoft.SecurityInsights deployed on top of Microsoft.OperationalInsights/workspaces), Azure CLI extension commands (az sentinel), and Terraform resources (azurerm_sentinel_*) remain unchanged, while Azure RBAC roles use Microsoft Sentinel Contributor / Reader / Responder.

Sources & official documentation

Catalog last updated . Spotted an error? Suggest an edit