Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Relate Alerts to Incidents in Microsoft Sentinel in the Azure Portal

4 September 2026Doc update+18 / −18 lines

In brief

The article’s title, date, metadata, wording, and limitations-section structure were updated. Guidance now clarifies Logic Apps connector wording, portal-specific alert management, bidirectional synchronization, and the 150-alert incident limit.

What Defender admins need to know

Review the updated limitations and portal guidance when managing Sentinel alerts and incidents.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Relate alerts to incidents in Microsoft Sentinel in the Azure portal

This article shows you how to relate alerts to your incidents in Microsoft Sentinel. This feature allows you to manually or automatically add alerts to, or remove them from, existing incidents in the Azure portal as part of your investigation processes, refining the incident scope as the investigation unfolds.

Expand the scope and power of your incidents

Relating alerts to incidents allows you to include alerts from one data source in incidents generated by another data source. For example, you can add alerts from Microsoft Defender for Cloud, or from various third-party data sources, to incidents imported into Microsoft Sentinel from Microsoft Defender XDR.

Because this featurethe alert-to-incident capability is built into the latest version of the Microsoft Sentinel API, the alert-to-incident capability isit's also available through the Logic Apps connector for Microsoft Sentinel. So you can use playbooks to automatically add an alert to an incident if certain conditions are met.

You can also use playbooks with the Logic Apps connector to add alerts to manually created incidents, to create custom correlations, or to define custom criteria for grouping alerts into incidents when they're created.

Limitations

Be aware of the following limitations when adding or removing alerts from incidents.

  • After onboarding Microsoft Sentinel to the Defender portal,portal, adding or removing Microsoft Sentinel alerts to or from incidents is supported only in the Defender portal. To remove an alert from an incident in the Defender portal, you must add the alert to another incident. For more information, see Understand how alerts are correlated and incidents are merged in the Defender portal.

  • When working in the Azure portal, in a workspace not onboarded to the Defender portal,portal, Microsoft Sentinel imports both alerts and incidents from Microsoft Defender XDR. For the most part, you can treat these alerts and incidents like regular Microsoft Sentinel alerts and incidents.

    For example, you can add or remove Microsoft Defender XDR alerts to or from non-Defender incidents, and add or remove non-Defender alerts to Defender incidents, directly from Microsoft Sentinel in the Azure portal.

    However, you can only manage Defender alerts with Defender incidents in the Defender portal. From the Azure portal, pivot to the incident in the Defender portal using the link in the incident. Changes made in the Defender portal are synchronized through bi-directional sync to the Azure portal, so you'll still see the change reflected in both portals.

  • An incident can contain a maximum of 150 alerts. If you try to add an alert to an incident with 150 alerts in it, you will'll get an error message.

Add alerts using the entity timeline (Preview)

The entity timeline, as featured in the new incident investigation experience (now in Preview), presents all the entities in a particular incident investigation. When an entity in the list is selected, a miniature entity page is displayed in a side panel.

  1. From the Microsoft Sentinel navigation menu, select Incidents.

  • The alert you want to add belongs to another incident, and it's the only alert in the other incident.

    ThisWhen the alert is the only alert in the other incident, the situation differs from the scenario wheremultiple-alert scenario, since tracking the other incident contains multiple alerts, since if thesole alert is alone in the other incident, tracking it in this incident could make the other incident irrelevant. So in this case, you'll see this dialog:

    :::image type="content" source="media/relate-alerts-to-incidents/keep-or-close-other-incident.png" alt-text="Screenshot asking whether to keep or close other incident.":::

| 404 Not found | Incident doesn’t exist. | | 409 Conflict | Failed to create relation. Relation with name {relationName} already exists in incident {incidentIdentifier} to different alert {systemAlertId}. |

Next stepsRelated content

In this article, you learned how to add alerts to incidents and remove them using the Microsoft Sentinel portal and API. For more information, see: