In a Microsoft Community Hub post on 11 November 2026, Microsoft set out its Sentinel agenda for Ignite 2026, which runs from 17 to 20 November in San Francisco and online. The main point for security operations teams is Sentinel’s role in the integrated SOC, where security information and event management and extended detection and response work with Microsoft Defender.
Microsoft frames the change around agentic security. Its argument is that agents used in security operations can only reason over and act on the data they can reach, so the quality, scope and governance of Sentinel data become operational concerns rather than background plumbing.
Sentinel in the integrated SOC
Microsoft describes Sentinel as a core part of the integrated SOC, or ISOC, in Microsoft Defender. The direction is to bring Sentinel SIEM data, Microsoft Defender XDR signals and third-party security data into one operating model for detection, investigation and response.
For practitioners, the important part is not the label. The practical questions are which data sources are ingested, how they are normalised, which teams can act across tenants, and whether ingestion health is visible before detections fail.
Ignite sessions
Microsoft points Sentinel users to three Ignite sessions as starting points for the week:
- BRK324, The Alert Is Dead. The Blueprint for the Agentic SOC, featuring Rob Lefferts, CVP of Defender.
- THR876, covering what is new with ISOC and expanded SIEM capabilities in a live demo.
- LTG1230, covering how security data from Microsoft and third-party sources supports detection, investigation and AI workflows.
Times, rooms and session links are in Microsoft’s Defender and Sentinel session guide. The set of sessions suggests that the product discussion will centre on the operating model as much as on individual Sentinel features.
Recent Sentinel changes
The October Sentinel update gives useful context for the Ignite agenda. Cross-tenant delegated access reached general availability, giving managed security service providers and central security teams a way to run operations across tenants with home-tenant accounts rather than local administrator or Microsoft Entra B2B guest accounts in each tenant.
That model uses the same governance relationship approach as Microsoft Entra Tenant Governance. Each governed tenant approves the relationship and grants roles and resource scopes through Defender unified role-based access control.
The Advanced Security Information Model EmailEvent schema also reached general availability. It gives email delivery and inspection events a common structure across supported sources, including sender and recipient information, subject, delivery location, URLs, file attachments and authentication results.
That matters for detection engineering. Queries, analytics rules and workbooks written against the common schema can work across sources when the relevant parser exists, instead of being rewritten for each email product’s field names and values.
Microsoft also listed a public preview analytics rule for SAP Business Technology Platform. The rule correlates SAP Application Vulnerability Report Service findings with SAP BTP audit logs to detect active use of custom apps with open high or critical vulnerabilities, using a default minimum CVSS score of 7.0 and a 14-day lookback.
Unified Data Management is another public preview item. It brings Sentinel connectors, tables and ingestion health into the Data & connectors experience in the Microsoft Defender portal, including daily ingestion volume by tier, connector issues, unexpected table spikes or drops, ingestion latency, schema, transformations, retention settings and estimated ingestion cost.
Connector expansion
Microsoft says Sentinel now has more than 500 connectors, with new and enhanced integrations announced around Ignite. The additions cover areas including attack surface data, identity attack paths, AI agent signals, privileged access, network detection and response, ransomware resilience, third-party risk, post-quantum cryptography readiness, SAP RISE logging, infrastructure as code audit logs and external threat intelligence.
The partner list is broad, but the operational pattern is consistent. More source data is being made available to Sentinel so analysts, detections and security agents can work from a wider set of context without keeping each tool in a separate console.
Microsoft also listed connectors published by the Sentinel team, including Microsoft Copilot, OpenAI, Zoom Reports, SentinelOne, Crowdstrike Falcon Endpoint Protection, AWS Elastic Kubernetes Service, Cisco Meraki Events, VMware Workspace ONE and others. Alongside the connectors, Microsoft continues to add platform capabilities for the Codeless Connector Framework, including Nested API support, Azure Blob Storage support and multi-account support.
Operational implications
The Ignite agenda is therefore not only a conference schedule. It reflects a product direction in which Sentinel’s value depends on data coverage, schema consistency, delegated access and portal-level visibility into ingestion.
For managed security service providers and central SOC teams, cross-tenant delegated access is the change to examine first. For detection engineers, the EmailEvent schema and other ASIM work affect how portable rules and hunting content can become. For platform owners, Unified Data Management is the piece to test against connector failures, ingestion latency and cost variance.
When Sentinel data, Defender XDR signals and third-party connectors become the working set for agentic SOC processes, ECS's Security topic is where teams examine those choices alongside Security Copilot, Zero Trust, Purview and DevSecOps. Sessions and practitioner discussions give attendees room to compare data ingestion models, access controls and operational experience from live security environments. Bring concrete Sentinel and Defender scenarios to ECS if the documentation leaves architectural or governance questions unresolved.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.