fairfax / Availability tables / Microsoft Sentinel
Microsoft Sentinel in Azure Government, GCC, GCC High and DoD
fairfax tracks 41 Microsoft Sentinel features in Azure Government: 14 not available, 6 in preview or available with limits, and 21 available. For the 13 Microsoft 365 data connectors, the answer depends on where your tenant lives and where your Sentinel workspace lives. Every row quotes Microsoft and links to the page it came from.
Microsoft Sentinel features: commercial Azure and Azure Government
| Feature and feature key | Commercial Azure | Azure Government | Source |
|---|---|---|---|
Microsoft Sentinel: Scheduled and Microsoft rulessentinel/scheduled-rulesMicrosoft: “Scheduled and Microsoft rules | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: NRT rulessentinel/nrt-rulesMicrosoft: “NRT rules | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Content hub and solutionssentinel/content-hubMicrosoft: “Content hub and solutions | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Repositoriessentinel/repositoriesMicrosoft: “Repositories | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Workbookssentinel/workbooksMicrosoft: “Workbooks | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Entra ID data connectorsentinel/connector/entra-idMicrosoft: “Microsoft Entra ID | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Entra ID Protection data connectorsentinel/connector/entra-id-protectionMicrosoft: “Microsoft Entra ID Protection | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Azure Activity data connectorsentinel/connector/azure-activityMicrosoft: “Azure Activity | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Azure Key Vault data connectorsentinel/connector/key-vaultMicrosoft: “Azure Key Vault | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Azure Information Protection (Preview) data connectorsentinel/connector/azure-information-protectionMicrosoft: “Azure Information Protection (Preview) | Deprecated | No | No”Microsoft lists this connector as deprecated. | Not available | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Codeless Connectors Platformsentinel/codeless-connector-platformMicrosoft: “Codeless Connectors Platform | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: DNS data connectorsentinel/connector/dnsMicrosoft: “DNS | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Defender for Cloud data connectorsentinel/connector/defender-for-cloudMicrosoft: “Microsoft Defender for Cloud | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Purview Insider Risk Management (Preview) data connectorsentinel/connector/purview-insider-riskMicrosoft: “Microsoft Purview Insider Risk Management (Preview) | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Purview (Preview) data connectorsentinel/connector/purviewMicrosoft: “Microsoft Purview (Preview) | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Purview Information Protection data connectorsentinel/connector/purview-information-protectionMicrosoft: “Microsoft Purview Information Protection | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Sentinel solution for Microsoft Business Appssentinel/business-apps-solutionMicrosoft: “Microsoft Sentinel solution for Microsoft Business Apps | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Summary rulessentinel/summary-rulesMicrosoft: “Summary rules | GA | Yes | No” | GA | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Syslog via AMA data connectorsentinel/connector/syslog-amaMicrosoft: “Syslog via AMA | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Common Event Format (CEF) via AMA data connectorsentinel/connector/cef-amaMicrosoft: “Common Event Format (CEF) via AMA | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Windows Security Events via AMA data connectorsentinel/connector/windows-security-events-amaMicrosoft: “Windows Security Events via AMA | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Huntssentinel/huntsMicrosoft: “Hunts | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Search large datasetssentinel/search-jobsMicrosoft: “Search large datasets | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Restore historical datasentinel/restoreMicrosoft: “Restore historical data | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Automation rulessentinel/automation-rulesMicrosoft: “Automation rules | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Run playbooks on incidentssentinel/playbooksMicrosoft: “Run playbooks on incidents | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Teams integrationssentinel/teams-integrationMicrosoft: “Microsoft Teams integrations | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Fusion - advanced multistage attack detectionssentinel/fusionMicrosoft: “Fusion - advanced multistage attack detections 1 | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Workspace managersentinel/workspace-managerMicrosoft: “Workspace manager | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: SIEM migration experiencesentinel/siem-migrationMicrosoft: “SIEM migration experience | GA | Yes | No” | GA | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Notebookssentinel/notebooksMicrosoft: “Notebooks | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: SOC optimizationssentinel/soc-optimizationsMicrosoft: “SOC optimizations | Supported for production use | Yes | No” | GA | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Threat protection for SAPsentinel/sap-threat-protectionMicrosoft: “Threat protection for SAP | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Agentless data connector data connectorsentinel/connector/sap-agentlessMicrosoft: “Agentless data connector | Limited preview | Yes | No” | Private preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: GeoLocation and WhoIs data enrichmentsentinel/geolocation-whois-enrichmentMicrosoft: “GeoLocation and WhoIs data enrichment | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Threat Intelligence - TAXII data connector data connectorsentinel/connector/ti-taxiiMicrosoft: “Threat Intelligence - TAXII data connector | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Microsoft Defender Threat intelligence matching analyticssentinel/mdti-matching-analyticsMicrosoft: “Microsoft Defender Threat intelligence matching analytics | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: URL detonationsentinel/url-detonationMicrosoft: “URL detonation | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Threat Intelligence Upload Indicators APIsentinel/ti-upload-apiMicrosoft: “Threat Intelligence Upload Indicators API | Public preview | Yes | Yes” | Preview | Preview | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Entity pagessentinel/ueba-entity-pagesMicrosoft: “Entity pages | GA | Yes | Yes” | GA | GA | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft Sentinel: Peer/Blast radius enrichmentssentinel/ueba-peer-blast-radiusMicrosoft: “Peer/Blast radius enrichments | Public preview | Yes | No” | Preview | Not available | Microsoft Learn updated 2026-09-29 checked 2026-10-12 |
Microsoft 365 data connectors by tenant and workspace cloud
Microsoft marks the other pairings as not possible for every connector: DoD tenant with a workspace in commercial Azure, GCC tenant with a workspace in Azure Government, GCC High tenant with a workspace in commercial Azure. A GCC tenant's data lives in commercial Azure, so a workspace in Azure Government can't reach it.
| Feature and feature key | GCC tenant, commercial Azure | GCC High tenant, Azure Government | DoD tenant, Azure Government | Source |
|---|---|---|---|---|
Office IRM data connector for Microsoft Sentinelsentinel/connector/office-irmMicrosoft: “Office IRM: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Not Available” | Preview | Preview | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Dynamics 365 data connector for Microsoft Sentinelsentinel/connector/dynamics-365Microsoft: “Dynamics 365: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | GA” | GA | GA | GA | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender XDR data connector for Microsoft Sentinelsentinel/connector/defender-xdrMicrosoft: “Microsoft Defender XDR: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | Not Available” | GA | GA | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Cloud Apps data connector for Microsoft Sentinelsentinel/connector/defender-for-cloud-appsMicrosoft: “Microsoft Defender for Cloud Apps: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | GA” | GA | GA | GA | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Cloud Apps / Shadow IT logs data connector for Microsoft Sentinelsentinel/connector/defender-for-cloud-apps-shadow-itMicrosoft: “Microsoft Defender for Cloud Apps / Shadow IT logs: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Public Preview” | Preview | Preview | Preview | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Cloud Apps / Alerts data connector for Microsoft Sentinelsentinel/connector/defender-for-cloud-apps-alertsMicrosoft: “Microsoft Defender for Cloud Apps / Alerts: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Public Preview” | Preview | Preview | Preview | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Endpoint data connector for Microsoft Sentinelsentinel/connector/defender-for-endpointMicrosoft: “Microsoft Defender for Endpoint: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | GA” | GA | GA | GA | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Identity data connector for Microsoft Sentinelsentinel/connector/defender-for-identityMicrosoft: “Microsoft Defender for Identity: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | GA” | GA | GA | GA | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Defender for Office 365 data connector for Microsoft Sentinelsentinel/connector/defender-for-office-365Microsoft: “Microsoft Defender for Office 365: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Not Available” | Preview | Preview | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Power BI data connector for Microsoft Sentinelsentinel/connector/power-biMicrosoft: “Microsoft Power BI: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Not Available” | Preview | Preview | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Microsoft Project data connector for Microsoft Sentinelsentinel/connector/projectMicrosoft: “Microsoft Project: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Public Preview ; Office 365 DoD | - | Not Available” | Preview | Preview | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Office 365 data connector for Microsoft Sentinelsentinel/connector/office-365Microsoft: “Office 365: Office 365 GCC | GA | - ; Office 365 GCC High | - | GA ; Office 365 DoD | - | GA” | GA | GA | GA | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
Teams data connector for Microsoft Sentinelsentinel/connector/teamsMicrosoft: “Teams: Office 365 GCC | Public Preview | - ; Office 365 GCC High | - | Not Available ; Office 365 DoD | - | Not Available” | Preview | Not available | Not available | Microsoft Learn updated 2026-09-03 checked 2026-10-12 |
How to read these tables
- GA and Available: Microsoft lists it as available.
- Preview, Private preview, Limited, Rolling out: available with conditions, or on its way.
- Not available, No plans, Planned, In development, On engineering backlog: you can't use it there today. These are Microsoft's own words. A planned date that has passed is marked, so you re-check it.
- Not possible: Microsoft says that pairing of clouds can't work.
- not listed: Microsoft's page doesn't give a status for that cloud.
A feature missing from this page tells you nothing about whether it works. fairfax only knows what is in its dataset.
Check your own plan
pip install fairfax
fairfax facts --grep sentinel
fairfax check plan.yaml # tenant, azure and the feature keys you plan to useThe feature keys in the tables above go straight into a plan file. See the plan format.
Sources
- Cloud feature availability for US Government customers: page updated 2026-09-03, checked 2026-10-12, 13 entries
- Microsoft Sentinel feature support for Azure commercial/other clouds: page updated 2026-09-29, checked 2026-10-12, 41 entries