Summarization and Current Limitations Firewall, DNS and proxy logs produce millions of events a day. Keeping them all in the Sentinel analytics tier is expensive; keeping them only in the data lake means no analytics rules can run on them. Summarization is the middle ground: the raw events stay in …

Exactly-Once Log Summaries with Sentinel data lake and Fabric Firewall, DNS and proxy logs produce millions of events a day. Keeping them all in Sentinel analytics tier is expensive; keeping them only in the data lake means no analytics rules on them. Summarization is the middle ground: the raw …

On 23 September 2026, Microsoft changed how new customers get the Microsoft Sentinel data lake experience. Most posts since then focus on the simpler onboarding, but the update also changes which features you get and how the APIs behave. The documentation does not cover all of it, so I tested it in …