Microsoft Sentinel
Cloud and workloadsWatchlists Manage
In brief
The documentation now says explicitly that uploading a file after removing items does not delete those items from the existing watchlist. It also updates the page metadata.
What Defender admins need to know
Administrators should individually delete removed items, or delete and recreate the watchlist when there are many deletions.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
When you have many items to add to a watchlist, use bulk update. A bulk update of a watchlist appends items to the existing watchlist. Then, it de-duplicates the items in the watchlist where all the value in each column match.
If you've deleted an item from your watchlist file and upload it,the file, bulk update won't delete the item in the existing watchlist. Delete the watchlist item individually. Or, when you have a lot of deletions, delete and recreate the watchlist.
The updated watchlist file you upload must contain the search key field used by the watchlist with no blank values.
@@ -4,12 +4,12 @@ description: Edit existing Microsoft Sentinel watchlists and add items to keep t author: EdB-MSFT ms.author: edbaynash ms.topic: how-to-ms.date: 06/15/2026+ms.date: 07/01/2026 appliesto: - Microsoft Sentinel in the Microsoft Defender portal - Microsoft Sentinel in the Azure portal ms.collection: usx-security-ms.custom: sfi-image-nochange, msecd-doc-authoring-1014+ms.custom: sfi-image-nochange, msecd-doc-authoring-1016 ai-usage: ai-assisted @@ -56,7 +56,7 @@ Edit a watchlist to edit or add an item to the watchlist. When you have many items to add to a watchlist, use bulk update. A bulk update of a watchlist appends items to the existing watchlist. Then, it de-duplicates the items in the watchlist where all the value in each column match. -If you've deleted an item from your watchlist file and upload it, bulk update won't delete the item in the existing watchlist. Delete the watchlist item individually. Or, when you have a lot of deletions, delete and recreate the watchlist.+If you've deleted an item from your watchlist file and upload the file, bulk update won't delete the item in the existing watchlist. Delete the watchlist item individually. Or, when you have a lot of deletions, delete and recreate the watchlist. The updated watchlist file you upload must contain the search key field used by the watchlist with no blank values.