Know what applies to you
Short questions, one per screen. “I don't know yet” keeps the work in your plan instead of hiding it.
Security / Microsoft Sentinel → Defender portal
ArMo MS Defender Migration Assistant
Move Microsoft Sentinel to the Defender portal, one clear step at a time.
After 31 March 2027, Microsoft Sentinel is no longer supported in the Azure portal. It continues in the Microsoft Defender portal.
- Available Tuesday 10 November
- Free to use
- Runs in your browser
- No account · no telemetry
The move
Moving isn't just a click.
The problem
Access, connectors, analytics rules, automation, integrations and SOC routines all change with the move. Miss one, and the SOC finds out in production.
The missing piece
A Swiss army knife for the migration: it walks your team through the whole move in a controlled, structured and documented way. What to check, where to click, and what to record.
How it works
Four stages, from readiness to sign-off.
Answer a few short questions about your environment (or skip them and see everything), and the assistant builds your plan. The overview always leads with the step to do now.
- PrepareReadiness across every workstream, before anything changes.
- TestOptional: rehearse the move before the real one.
- TransitionA runbook for the day itself, with go / no-go gates.
- ValidateCheck everything works, record the residual risk, and sign off.
Why teams use it
01
02
03
04
05
06
Clear steps. Documented decisions.
Always know the next step
The route shows where you are between the Azure portal and the Defender portal, and what to do now.
Do each step correctly
Exact portal locations, clear instructions and read-only queries, with the permissions needed and how to read the results.
Keep the proof
Attach screenshots and observations. A step counts as verified only with evidence, and exceptions need a named owner.
A report at every stage
Readiness, execution and final validation reports for stakeholders, printable to PDF, with fingerprinted snapshots.
From the field
Built by security professionals from the field, enriched with Microsoft's recommendations and best practices, with every source dated.
Privacy
Your data is yours: stated precisely.
Nothing leaves your machine
The assistant is a single HTML file that runs in your browser. It carries a security policy that makes the browser block every network request. No account, no cloud backend, no telemetry.
Everything stays on your device
Your project lives in your browser tab, in your browser's storage if you turn on autosave, and in files you save. Nothing is uploaded to us.
Handle saved files with care
Files you save are not encrypted. Treat them like any confidential document.
Open for review
Every line of the code is readable in the file. Check it before you use it.
Honest scope
What it is, and what it isn't.
Guidance, with sources
Built from current Microsoft Learn pages, with dates, and clearly labelled practical experience.
Not Microsoft software
Not a certification and not a warranty. You remain responsible for checking guidance, approvals and changes.
No live connection
It never connects to your tenant. A read-only inventory script lets you import the facts yourself.
Let's talk Cyber Defense · Episode 2
Built to make your migration journey easy.
Arno and Moïse walk you through it in the next vodcast episode, on Tuesday 10 November. Follow ArMoHub so you don't miss the release.
Microsoft, Microsoft Sentinel, Microsoft Defender and Azure are trademarks of the Microsoft group of companies. The ArMo MS Defender Migration Assistant is independent and is not affiliated with or endorsed by Microsoft.