Microsoft said on 28 October 2026 that Microsoft Sentinel now has more than 500 connectors, extending the range of Microsoft and third-party data sources available to security operations teams. In the Microsoft Tech Community post, the company tied the expansion to the Integrated Security Operations Center (ISOC) in Microsoft Defender, where Sentinel data contributes to investigation and response workflows.
The connector catalogue now covers Microsoft services, non-Microsoft security products, multicloud environments, applications, infrastructure and custom sources. Microsoft says the aim is to bring more security signals into one operational view so analysts and AI agents have shared context for detection, investigation and response.
What the connector count changes
For security operations centre teams, the practical effect is broader coverage inside Sentinel rather than a change to the basic ingestion model. Data can arrive through built-in service-to-service connectors, partner connectors, Syslog, Common Event Format, REST APIs, Azure Monitor Agent, Logstash, the Logs Ingestion API or the Codeless Connector Framework.
The March 2026 connector update showed the range of sources Microsoft and partners are targeting. It listed integrations for data protection, privileged access, threat intelligence, endpoint response, mobile threat defence, SaaS activity, SAP monitoring, micro-segmentation, Zscaler Internet Access and GitHub Enterprise Audit Logs.
The Copilot data connector is one example of the direction of travel. It became generally available in March 2026 and ingests audit logs and activities from Copilot offerings into Microsoft Sentinel and Sentinel data lake, where teams can use the data in detections, workbooks and automation.
That connector is available to Sentinel customers, but it only ingests data from environments with Copilot licences and Security Compute Units where Copilot activity exists. It is also a single-tenant connector. Microsoft states that data ingestion costs apply, based on the Microsoft Sentinel workspace settings or Sentinel data lake tier pricing.
Build and support routes
Microsoft is also pushing partners towards the Codeless Connector Framework. The company says its Sentinel connector builder agent can turn API documentation into a working connector in minutes, and partners can request engineering guidance for new or updated connectors.
Customers are not limited to catalogue entries. Where a source is not covered by an existing solution, Microsoft documents routes for custom connectors through the Codeless Connector Framework, the Logs Ingestion API with an Azure Function or Logic App, Azure Monitor Agent or Logstash.
Admins still need to check the support type on each connector page. Microsoft-supported connectors are maintained under Azure Support Plans, partner-supported connectors direct issues to the listed partner contact, and community-supported connectors route questions through the Microsoft Sentinel GitHub community.
Operational constraints
The connector expansion sits alongside changes that affect existing deployments. Microsoft documentation says the legacy HTTP Data Collector API is no longer supported after 14 September 2026, and data sources, custom integrations or connectors using it should move to the Logs Ingestion API or the Codeless Connector Framework.
Portal planning also matters. After 31 March 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. Customers still using Sentinel in the Azure portal will be redirected to Defender.
Sentinel data lake adds further planning points. Microsoft documentation states that tenant admins can use Purge for the analytics tier, but specific records cannot be purged from the data lake tier. Data lake storage locations are selected by the tenant admin and may differ from the primary storage location of the source services, and Purview settings do not affect data stored in the Sentinel data lake.
September 2026 updates also added public previews that affect connector use in larger environments. A single Codeless Connector Framework connector can bring in data from many accounts, tenants or environments into one Sentinel workspace, with each connection shown separately and managed independently. Case Management in Defender entered public preview on 23 September 2026, while unified role-based access control custom roles for granular delegated admin privileges give tenants more control over what managed security service providers and partners can access.
Choosing which Sentinel connectors to trust, how their data is retained and how partner access is scoped are operating questions ECS's Security topic examines alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give attendees a place to compare connector choices, data retention settings, RBAC scoping and migration from older ingestion APIs with people running similar security operations. Bring current Sentinel workspaces, partner access models and ingestion plans for discussion at the conference.
Photo: mikemacmarketing, CC BY 2.0, via Wikimedia Commons, cropped
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.