Microsoft Sentinel
Cloud and workloadsConfigure Table Settings in Microsoft Sentinel
In brief
The page now focuses on retention and data tier settings for Sentinel and Defender XDR tables, adds Table insights for monitoring ingestion health and costs, and revises its permissions section and related-content links.
What Defender admins need to know
Administrators using this guidance should review the updated scope and permissions table when configuring or monitoring table settings.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Configure table settings in Microsoft Sentinel
Permissions to manage table settings
The following table lists the permissions required to view or configure table settings.
| Action | Unified |
Microsoft Sentinel workspace permissions |
|---|---|---|
| View table settings | Security data basics (read) permissions under the Security operations permissions group |
Microsoft.OperationalInsights/workspaces/tables/read permissions to the Log Analytics workspace, as provided by the Log Analytics Reader built-in role, for example. |
| Configure table settings | Data (manage) permissions under the Data operations permissions group |
Microsoft.OperationalInsights/workspaces/write and Microsoft.OperationalInsights/workspaces/tables/write permissions to the Log Analytics workspace, as provided by the Log Analytics Contributor built-in role, for example. |
| Alerting | Table insights is a visualization surface only. To alert on table health, such as when a connector goes silent, create a scheduled analytics rule that uses the SentinelHealth table or a Kusto Query Language (KQL) query against Usage or a table-specific schema. |
|
| Multi-workspace view | Table insights shows data for the currently selected workspace only. If you manage multiple workspaces, switch workspaces to review each one separately. |
Next stepsRelated content
Learn more about:
@@ -1,14 +1,14 @@ ----title: Configure table settings in Microsoft Sentinel-description: Configure Microsoft Sentinel and Defender XDR table settings in the Microsoft Defender portal to optimize security operations and cost efficiency.+title: Configure Table Settings in Microsoft Sentinel+description: Configure retention and data tier settings for Microsoft Sentinel and Defender XDR tables in the Microsoft Defender portal, and use Table insights to monitor ingestion health and optimize costs. ms.author: guywild author: guywi-ms ms.reviewer: noak ms.topic: how-to-ms.date: 06/24/2026+ms.date: 07/02/2026 # Customer intent: As an IT administrator or subscription owner, I want to manage Microsoft Sentinel and Defender XDR table tiers and retention settings in the Microsoft Defender portal to optimize security operations and cost efficiency. ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 --- # Configure table settings in Microsoft Sentinel@@ -30,7 +30,9 @@ Microsoft Sentinel workspace permissions let you view or manage tables in specif ### Permissions to manage table settings -| Action | Unified role-based access control (RBAC) in the Defender portal | Microsoft Sentinel workspace permissions |+The following table lists the permissions required to view or configure table settings.++| Action | Unified RBAC in the Defender portal | Microsoft Sentinel workspace permissions | | --- | --- | --- | | View table settings | `Security data basics (read)` permissions under the `Security operations` permissions group | `Microsoft.OperationalInsights/workspaces/tables/read` permissions to the Log Analytics workspace, as provided by the [Log Analytics Reader built-in role](/azure/azure-monitor/logs/manage-access#log-analytics-reader), for example. | | Configure table settings | `Data (manage)` permissions under the `Data operations` permissions group | `Microsoft.OperationalInsights/workspaces/write` and `Microsoft.OperationalInsights/workspaces/tables/write` permissions to the Log Analytics workspace, as provided by the [Log Analytics Contributor built-in role](/azure/azure-monitor/logs/manage-access#log-analytics-contributor), for example. |@@ -159,9 +161,7 @@ Keep the following limits in mind when you interpret the **Table insights** data | Alerting | **Table insights** is a visualization surface only. To alert on table health, such as when a connector goes silent, create a scheduled analytics rule that uses the `SentinelHealth` table or a Kusto Query Language (KQL) query against `Usage` or a table-specific schema. | | Multi-workspace view | **Table insights** shows data for the currently selected workspace only. If you manage multiple workspaces, switch workspaces to review each one separately. | -## Next steps--Learn more about:+## Related content - [Microsoft Sentinel data lake](datalake/sentinel-lake-overview.md) - [KQL jobs in Microsoft Sentinel](datalake/kql-jobs.md)