Microsoft Sentinel
Cloud and workloadsMigration
In brief
The page metadata was updated, and the migration-process heading and explanatory text were refined. A named anchor was also added for the migration-process section.
What Defender admins need to know
No administrator action is indicated; the updated wording and anchor make the migration guidance easier to navigate and reference.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
This article discusses the reasons for migrating from a legacy SIEM, and describes how to plan out the different phases of your migration.
Understand the Microsoft Sentinel migration process
In this guide, you learn how to migrate your legacy SIEM to Microsoft Sentinel. Follow your migration process through this series of articles, in which you'll learn how to navigate different steps in the process.
During the planning phase, you identify your existing SIEM components, your existing SOC processes, and you design and plan new use cases. Thorough planning allows you to maintain protection for both your cloud-based assets—Microsoft Azure, AWS, or GCP—and your SaaS solutions, such as Microsoft Office 365.
ThisThe following migration phases diagram describes the high-level phases that a typical migration includes. Each phase includes clear goals, key activities, and specified outcomes and deliverables.
The phases in thisthe migration phases diagram are a guideline for how to complete a typical migration procedure. An actual migration may not include some phases or may include more phases. Rather than reviewing the full set of phases, the Microsoft Sentinel migration tasks and steps review specific tasks and steps that are especially important to a Microsoft Sentinel migration.
:::image type="content" source="media/migration-overview/migration-phases.png" alt-text="Diagram of the Microsoft Sentinel migration phases." lightbox="media/migration-overview/migration-phases.png" border="false":::
@@ -6,11 +6,11 @@ author: guywi-ms ms.reviewer: soulisabag ms.service: microsoft-sentinel ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/02/2026 ms.collection: - migration ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a SOC team leader, I want to migrate from a legacy SIEM to Microsoft Sentinel so that I can improve threat detection, automate responses, and ensure comprehensive coverage of both on-premises and cloud assets. ---@@ -22,7 +22,8 @@ Security operations center (SOC) teams use centralized security information and This article discusses the reasons for migrating from a legacy SIEM, and describes how to plan out the different phases of your migration. <a name="migration-steps"></a>-## Microsoft Sentinel migration process+<a name="microsoft-sentinel-migration-process"></a>+## Understand the Microsoft Sentinel migration process In this guide, you learn how to migrate your legacy SIEM to Microsoft Sentinel. Follow your migration process through this series of articles, in which you'll learn how to navigate different steps in the process. @@ -60,9 +61,9 @@ A cloud-native SIEM addresses these challenges. Microsoft Sentinel collects data During the planning phase, you identify your existing SIEM components, your existing SOC processes, and you design and plan new use cases. Thorough planning allows you to maintain protection for both your cloud-based assets—Microsoft Azure, AWS, or GCP—and your SaaS solutions, such as Microsoft Office 365. -This diagram describes the high-level phases that a typical migration includes. Each phase includes clear goals, key activities, and specified outcomes and deliverables. +The following migration phases diagram describes the high-level phases that a typical migration includes. Each phase includes clear goals, key activities, and specified outcomes and deliverables. -The phases in this diagram are a guideline for how to complete a typical migration procedure. An actual migration may not include some phases or may include more phases. Rather than reviewing the full set of phases, the [Microsoft Sentinel migration tasks and steps](#migration-steps) review specific tasks and steps that are especially important to a Microsoft Sentinel migration.+The phases in the migration phases diagram are a guideline for how to complete a typical migration procedure. An actual migration may not include some phases or may include more phases. Rather than reviewing the full set of phases, the [Microsoft Sentinel migration tasks and steps](#migration-steps) review specific tasks and steps that are especially important to a Microsoft Sentinel migration. :::image type="content" source="media/migration-overview/migration-phases.png" alt-text="Diagram of the Microsoft Sentinel migration phases." lightbox="media/migration-overview/migration-phases.png" border="false":::