Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Architecture and deployment

Deploy Custom Content from your Repository

4 September 2026Doc update+17 / −19 lines

In brief

Updated the article’s title, metadata, wording, punctuation, and formatting. The deployment status section is now a top-level heading, and repository connection removal instructions were streamlined.

What Defender admins need to know

Administrators may see revised navigation and wording when following the guide. No administrator action is specified.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Deploy content as code from your repository

When creating custom content, you can manage it from your own Microsoft Sentinel workspaces,workspaces or an external source control repository. This article describes how to create and manage connections between Microsoft Sentinel and GitHub or Azure DevOps repositories. Managing your content in an external repository allows you to make updates to that content outside of Microsoft Sentinel,Sentinel and have the updated content automatically deployed to your workspaces. For more information, see Update custom content with repository connections.

Microsoft Sentinel currently supports connections to GitHub and Azure DevOps repositories. Before connecting your Microsoft Sentinel workspace to your source control repository, make sure that:

  • You have an Owner role in the resource group that contains your Microsoft Sentinel workspaceworkspace.
  • Custom content files you want to deploy to your workspaces are in a supported format. For supported formats, see Plan your repository content.
  • The account you use to create the connection is in your home tenant. External identities,identities such as B2B guest accounts,accounts and delegated access aren’t supported.
  • (Custom detection rules only): A Microsoft 365 E5 license (or equivalent license that includes Microsoft Defender XDR) and Microsoft Sentinel workspaces onboarded to the Microsoft Defender portal. For more information, see Deploy custom detection rules as code.

GitHub prerequisites

  1. Make sure that you're signed into your source control app with the credentials you want to use for your connection. If you're currently signed in using different credentials, sign out first.

  2. For Microsoft Sentinel in the Azure portal, under Content management, select Repositories.

    For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Repositories.

  3. Select Add new, and then, on the Create new deployment connection page, enter a meaningful name and description for your connection.

    Azure DevOps

    You're automatically authorized to Azure DevOps using your current Azure credentials. Verify that you're authorized to the same Azure DevOps tenant that you're connecting to from Microsoft Sentinel or use an InPrivate browser window to create your connection.

    1. In Microsoft Sentinel, from the dropdown lists that appear, select your Organization, Project, Repository, Branch, and Content Types.

      • Both parsers and hunting queries use the Saved Searches API to deploy content to Microsoft Sentinel. If you select one of these content types, and also have content of the other type in your branch, both content types are deployed.

After you create the connection, a new workflow or pipeline is generated in your repository. The content stored in your repository is deployed to your Microsoft Sentinel workspace.

The deployment time might vary depending on the volume of content that you're deploying.

View the deployment status

In GitHub: On the repository's Actions tab, select the workflow .yaml file to access detailed deployment logs and any specific error messages. 

:::image type="content" source="media/ci-cd/deployment-logs-status.png" alt-text="Screenshot of a GitHub repository connection's deployment logs.":::

The default workflow only deploys content that is modified since the last deployment based on commits to the repository. Butrepository, but you might want to turn off smart deployments or perform other customizations. For example, you can configure different deployment triggers, or deploy content exclusively from a specific root folder. To learn more, see Customize repository deployments.

Edit content

Remove a repository connection

This procedure describesThe following steps describe how to remove the connection to a source control repository from Microsoft Sentinel. In order to use Bicep files, your repository connection must be newer than November 1, 2024. Use this procedure to remove the connection and recreate it in order to update the connection.

To remove your connection:connection:

  1. In Microsoft Sentinel, under Content management, select Repositories.
  2. In the grid, select the connection you want to remove, and then select Delete.

Related content

Use your custom content in Microsoft Sentinel in the same way that you'd use out-of-the-box content.

For more information, see: