Microsoft Sentinel Installation Tutorial: Step-by-Step Guide for Beginners

Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform. It helps organizations collect security logs, detect suspicious activities, investigate cyber threats, and automate security operations.

In this tutorial, you will learn how to set up Microsoft Sentinel from scratch using Microsoft Azure. You will also learn how to connect security logs, run Kusto Query Language (KQL) queries, create detection rules, and investigate security incidents.

This guide is suitable for cybersecurity students, beginners, IT administrators, SOC analysts, and professionals preparing for security operations roles.

Table of Contents

1. What Is Microsoft Sentinel?
2. How Microsoft Sentinel Works
3. Prerequisites for Installation
4. Step 1: Create an Azure Account
5. Step 2: Create a Resource Group
6. Step 3: Create a Log Analytics Workspace
7. Step 4: Enable Microsoft Sentinel
8. Step 5: Install a Solution from Content Hub
9. Step 6: Connect Azure Activity Logs
10. Step 7: Verify Security Logs
11. Step 8: Connect Windows Security Events
12. Step 9: Learn Basic KQL Queries
13. Step 10: Create Your First Analytics Rule
14. Step 11: Investigate Security Incidents
15. Step 12: Create Workbooks and Explore Automation
16. Common Installation Problems and Solutions
17. Microsoft Sentinel Pricing and Cost Management
18. Practical SOC Lab Exercise
19. Career Opportunities After Learning Microsoft Sentinel
20. Conclusion

1. What Is Microsoft Sentinel?

Microsoft Sentinel is a security monitoring platform hosted in Microsoft Azure. It collects data from different systems and uses analytics to identify suspicious activities.

For example, imagine an organization has 100 computers, several servers, Microsoft 365 accounts, and cloud applications. Monitoring each system separately can be difficult.

Microsoft Sentinel brings security information from supported sources into a central workspace, allowing security teams to investigate activities from one platform.

Major features of Microsoft Sentinel

Security Information and Event Management (SIEM): Collects and analyzes logs from connected systems to help identify security threats.

Security Orchestration, Automation, and Response (SOAR): Automates selected investigation and response tasks using playbooks and supported integrations.

Threat detection: Uses analytics rules, queries, and other detection capabilities to identify potentially malicious activities.

Incident investigation: Helps analysts investigate alerts, correlate events, and understand what happened.

Threat hunting: Allows analysts to search collected data for suspicious patterns that might not have generated an alert.

Security dashboards: Workbooks help visualize security events and operational trends.

2. How Microsoft Sentinel Works

Before installing Microsoft Sentinel, understand the basic architecture.

The following is a simplified view of the process:

Security data sources → Data connectors → Log Analytics workspace → Analytics and detection → Alerts and incidents → Investigation and response.

Main components

1. Data sources

These are the systems that generate security information, such as Windows computers, cloud services, identity systems, firewalls, and supported third-party applications.

2. Data connectors

Connectors bring supported data into the appropriate workspace. The configuration depends on the source.

3. Log Analytics workspace

This is the central location where supported logs are stored and queried.

4. Analytics rules

These rules analyze collected data to identify conditions that may indicate suspicious behavior.

5. Incidents

Related alerts can be grouped into incidents for investigation.

6. Automation

Playbooks and automation rules can support response activities, such as notifying a security team or initiating an approved workflow.

Understanding these components will make the installation process easier.

3. Prerequisites for Microsoft Sentinel Installation

Before beginning, prepare the following items.

• An active Microsoft Azure subscription.
• A Microsoft account or organizational account with appropriate Azure access.
• Permission to create resources and configure the Sentinel workspace.
• A supported web browser.
• A data source for testing.
• An understanding of basic networking and Windows security concepts.

For this tutorial, we will start with Azure Activity logs. Connecting Windows security logs will be covered separately.

Recommended lab configuration

Use these example resource names throughout the tutorial:

ResourceExample nameResource groupRG-Sentinel-LabLog Analytics workspacelaw-sentinel-labRegionAn available region suitable for your deploymentData sourceAzure Activity logs

These are suggested names, not mandatory values. Choose a region that supports the services you need and satisfies your organization's data residency requirements.

Important: Microsoft Sentinel is a cloud service. You do not need to download and install the complete Sentinel platform on your Windows computer.

4. Step 1: Create a Microsoft Azure Account

The first step is to access Microsoft Azure.

Instructions

1. Open your browser.
2. Visit https://portal.azure.com.
3. Sign in using your Microsoft account or organizational account.
4. Complete any requested identity verification.
5. Open the Azure portal.
6. Search for Subscriptions.
7. Confirm that you have an active subscription.

If you do not have a subscription, follow Microsoft's official Azure signup process.

You might be eligible for Azure trial benefits, depending on your account and eligibility. Check the applicable terms before activating resources.

Verification

You should be able to open the Subscriptions page and identify the subscription you will use for your lab.

If you cannot create resources, check whether the subscription is active and whether your account has sufficient permissions.

5. Step 2: Create an Azure Resource Group

A resource group is a logical container for related Azure resources. For this lab, it will help you organize your workspace and related resources.

Instructions

1. Sign in to https://portal.azure.com.
2. Search for Resource groups.
3. Open the Resource groups page.
4. Select Create.
5. Select your Azure subscription.
6. Enter the resource group name:
7. RG-Sentinel-Lab
8. Choose an appropriate region.
9. Select Review + Create.
10. Review the configuration.
11. Select Create.

Verification

Open Resource groups and confirm that RG-Sentinel-Lab appears in the list.

Keep your lab resources organized. This makes it easier to understand which resources belong to your security environment and to clean them up when testing is complete.

6. Step 3: Create a Log Analytics Workspace

Microsoft Sentinel requires a supported Log Analytics workspace.

The workspace stores the logs that you collect and provides the environment where you can query them.

Instructions

1. In Azure Portal, search for Log Analytics workspaces.
2. Open the service.
3. Select Create.
4. Select your Azure subscription.
5. Choose the resource group RG-Sentinel-Lab.
6. Enter the workspace name:
7. law-sentinel-lab
8. Choose a supported region.
9. Review the configuration.
10. Select Review + Create.
11. Wait for validation to complete.
12. Select Create.
13. Wait until deployment finishes.
14. Open the newly created workspace.

Why is the workspace important?

Microsoft Sentinel uses the workspace to access the data that it analyzes. The workspace also has configuration settings that affect log collection, access, and retention.

Choose the workspace carefully because moving a deployed Sentinel workspace between subscriptions or resource groups is not supported as a simple move operation.

Verification checklist

• The workspace exists.
• The deployment completed successfully.
• You can open the workspace.
• Your account has the necessary permissions.

Official documentation: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/quick-create-workspace

7. Step 4: Enable Microsoft Sentinel

Now that your workspace is ready, enable Microsoft Sentinel on it.

Instructions

1. Open Azure Portal.
2. Search for Microsoft Sentinel.
3. Open Microsoft Sentinel.
4. Select Create or the available workspace onboarding option.
5. Locate law-sentinel-lab.
6. Select the workspace.
7. Choose Add or the equivalent onboarding action.
8. Wait for the configuration to complete.

The precise labels can vary depending on the portal experience and your permissions.

Microsoft is transitioning Sentinel management toward the Microsoft Defender portal. You may therefore see different navigation options depending on the current interface.

Verification

Open the Sentinel workspace and confirm that its security configuration pages are accessible.

You should now be ready to configure data sources.

Official onboarding guide:

https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard

8. Step 5: Install a Solution from Content Hub

The Content Hub provides solutions containing supported connectors, analytics rules, workbooks, hunting queries, and other security content.

For your first lab, install the Azure Activity solution.

Instructions

1. Open Microsoft Sentinel.
2. Select Content hub.
3. Search for Azure Activity.
4. Open the Azure Activity solution.
5. Review its description and included content.
6. Select Install.
7. Wait for installation to complete.

Installing the solution makes its associated content available. You may still need to configure its connector and permissions before events appear in your workspace.

Why install a solution?

Solutions provide ready-made components that can reduce manual configuration. Instead of building every connector and query yourself, you can start with supported content and customize it later.

For more information, visit:

https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard

9. Step 6: Connect Azure Activity Logs

Azure Activity logs record subscription-level management operations, such as resource creation, configuration changes, and other control-plane activities.

They are a useful starting point for understanding cloud security monitoring.

Instructions

1. Open Microsoft Sentinel.
2. Navigate to Data connectors or the equivalent connector section.
3. Search for Azure Activity.
4. Select the connector.
5. Open its configuration page.
6. Follow the instructions displayed for your environment.
7. If prompted, launch the Azure Policy Assignment Wizard.
8. Select the subscription or scope whose activity you want to collect.
9. Set the primary Log Analytics workspace to law-sentinel-lab.
10. Review the configuration.
11. Select Create or the appropriate deployment action.
12. Wait for the assignment to complete.

The exact connector setup depends on your subscription, permissions, and the current Azure interface.

Generate test activity

To create events for your lab, perform a harmless operation in your test resource group, such as opening a resource and updating an appropriate non-security-critical tag.

Use only resources you own or are authorized to manage.

Allow time for events to be collected and ingested.

Verification

Proceed to the Logs page and query the AzureActivity table. If events are present, the connection is working.

10. Step 7: Verify That Logs Are Arriving

Connecting a data source is not enough. A security analyst must verify that data is actually being collected.

Open the Logs page

1. Open your Log Analytics workspace or Sentinel workspace.
2. Select Logs.
3. Choose the appropriate workspace scope if prompted.
4. Enter the following query.

AzureActivity
| take 20

1. Select Run.

The query requests up to 20 records from the AzureActivity table.

Check recent events

Use this query to count events received during the last 24 hours.

AzureActivity
| where TimeGenerated > ago(24h)
| summarize EventCount = count()

If the query returns a nonzero count, the table contains recent records.

If the count is zero, check the connector configuration, subscription scope, workspace selection, permissions, and ingestion delay.

Note: A successful query does not automatically mean that every required event type is being collected. Validate the source and expected event coverage.

11. Step 8: Connect Windows Security Events

After configuring Azure Activity logs, you can extend your lab by collecting Windows security events.

This allows you to practice analyzing sign-ins, account activity, and other Windows security events.

The recommended approach for supported Windows hosts is generally the Windows Security Events via Azure Monitor Agent (AMA) connector.

Important requirements

For Azure virtual machines, follow the supported Azure Monitor Agent setup.

For Windows servers outside Azure, additional configuration through Azure Arc-enabled servers is required for this connector.

A normal Windows 10 or Windows 11 computer is not automatically connected to Sentinel merely because you created a workspace. Check the current supported-device requirements before choosing your data source.

Installation procedure

1. Open Microsoft Sentinel.
2. Open Content hub.
3. Search for Windows Security Events.
4. Open the relevant solution.
5. Select Install, if required.
6. Open the Windows Security Events via AMA connector.
7. Review the prerequisites and setup instructions.
8. Select the option to create a data collection rule.
9. Enter a name, such as DCR-Windows-Security-Lab.
10. Select the supported Windows machine or machines in the Resources section.
11. Choose the required security event collection level.
12. Review the configuration.
13. Create the data collection rule.
14. Wait for the agent and data collection configuration to become operational.

For a first test, use a dedicated lab machine and collect only the events you need. Collecting every available event can increase ingestion costs.

Verify Windows events

Run this KQL query:

SecurityEvent
| take 20

To inspect recent events:

SecurityEvent
| where TimeGenerated > ago(24h)
| summarize EventCount = count()

If data arrives, you can begin investigating Windows security activity.

If the table does not exist or contains no events, check whether the correct connector and data collection rule are configured. Confirm that your chosen collection level includes the events you expect.

Official reference:

https://learn.microsoft.com/en-us/azure/sentinel/connect-services-windows-based

12. Step 9: Learn Basic Kusto Query Language (KQL)

Kusto Query Language is used to search and analyze data in Microsoft Sentinel.

You do not need to become an expert before starting. Learn the basic operators first.

Query 1: Display recent Azure activity

AzureActivity
| take 20

This displays up to 20 records.

Query 2: Filter events by time

AzureActivity
| where TimeGenerated > ago(24h)
| take 100

This returns up to 100 records from the previous 24 hours.

Query 3: Count events by operation

AzureActivity
| summarize EventCount = count() by OperationName
| order by EventCount desc

This groups records by operation name and sorts the most frequent operations first.

Query 4: Investigate Windows logon events

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624 or EventID == 4625
| project TimeGenerated, Computer, EventID, Account
| order by TimeGenerated desc

Windows Security event ID 4624 commonly represents a successful logon, while 4625 commonly represents a failed logon.

This query is useful for learning how to inspect authentication-related activity. The meaning of an event must still be assessed in context.

Query 5: Count failed Windows logons by account

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| summarize FailedLogons = count() by Account
| order by FailedLogons desc

This helps identify accounts associated with many failed logon events.

A high number of failures can have several explanations, including mistyped passwords, misconfigured applications, and potential password attacks. It is not proof of malicious activity by itself.

Query 6: Review activity by caller

AzureActivity
| where TimeGenerated > ago(24h)
| summarize EventCount = count() by Caller
| order by EventCount desc

This groups Azure activity by caller identity when the field is available in the collected records.

Important KQL note

The field names and tables depend on the data connector and collection configuration. If a query references a missing table or column, inspect the available schema and adjust the query.

13. Step 10: Create Your First Analytics Rule

Analytics rules analyze collected data and can generate alerts or incidents when specified conditions are met.

For this beginner exercise, create a basic rule that demonstrates how query-based detection works.

Instructions

1. Open Microsoft Sentinel.
2. Select Analytics.
3. Select Create.
4. Choose a scheduled query rule.
5. Enter a name:
6. Sentinel Lab - Azure Activity
7. Set the severity and other rule details.
8. Open the rule query editor.
9. Enter the following query.

AzureActivity
| where TimeGenerated > ago(1h)
| summarize EventCount = count() by Caller
| where EventCount > 0

1. Configure the query schedule and lookback period.
2. Configure alert grouping and incident creation options as appropriate.
3. Review the rule configuration.
4. Save the rule.

The exact wizard steps depend on the current Sentinel interface.

What does this rule do?

It counts Azure activity records by caller over the previous hour and returns callers with at least one event.

This is a demonstration rule, not a useful production threat detection. Because it matches ordinary activity, it may generate noise. A production rule should detect a meaningful risk pattern and use appropriate thresholds, exclusions, entity mappings, and testing.

Improve your detection rules

For a realistic security monitoring environment:

• Define the threat scenario you want to detect.
• Understand the relevant log schema.
• Test the query against historical data.
• Set suitable scheduling and lookback periods.
• Reduce false positives.
• Configure useful incident details.
• Document the investigation and response process.
• 
  

14. Step 11: Investigate Security Incidents

When a rule generates an incident, an analyst must examine the evidence before deciding whether it represents a real threat.

Investigation procedure

1. Open the Incidents page.
2. Select an incident for investigation.
3. Review its title, severity, status, and associated alerts.
4. Inspect the entities and events included in the incident.
5. Review related activity in Logs using KQL.
6. Determine whether the activity is expected or suspicious.
7. Record the evidence and investigation notes.
8. Escalate or resolve the incident according to your organization's procedures.

Example scenario

Suppose a security rule reports repeated failed logons.

The analyst should investigate:

• Which account experienced the failures?
• Which computer or service generated the events?
• When did the failures occur?
• Were there successful logons around the same time?
• Is the activity consistent with normal user behavior?
• Is there supporting evidence of unauthorized access?

Do not disable accounts, block network traffic, or execute response actions solely because a single alert was generated. Validate the evidence and follow the approved incident response process.

15. Step 12: Explore Workbooks, Hunting, and Automation

Once your lab receives data, explore additional Sentinel features.

Workbooks

Workbooks provide visual summaries of collected security information.

To explore them:

1. Open Microsoft Sentinel.
2. Navigate to Workbooks.
3. Review the available templates.
4. Select a suitable workbook.
5. Configure the required parameters and data sources.
6. Save a customized version if needed.

Hunting

Hunting allows analysts to search for suspicious patterns that might not have triggered an existing rule.

Start by adapting the KQL queries from this tutorial. Investigate unusual event counts, unfamiliar accounts, and unexpected operations.

Automation

Automation rules and playbooks can support tasks such as notifications, ticket creation, and selected response actions.

Begin with a low-risk action, such as sending a notification to an authorized test destination. Validate permissions and test the workflow before enabling any action that changes accounts, devices, or production systems.

16. Common Microsoft Sentinel Installation Problems

Problem 1: The workspace is not visible

Possible causes:

• The subscription is incorrect.
• Your account lacks required permissions.
• The workspace is not supported for the selected onboarding scenario.
• The workspace has not finished deploying.

Solution: Verify the subscription, workspace, deployment status, and required role assignments.

Problem 2: No data appears in Logs

Possible causes:

• The data connector has not been configured.
• The wrong workspace or subscription was selected.
• No relevant activity has occurred.
• Data ingestion is delayed.
• The required permissions or data collection rules are missing.

Solution: Verify the connector setup, generate authorized test activity, wait for ingestion, and run the appropriate table query again.

Problem 3: The table does not exist

Possible causes:

• The source has not sent data to the workspace.
• The wrong table name was used.
• The selected connector writes to a different table.

Solution: Confirm the connector's documented destination table and inspect the tables available in your workspace.

Problem 4: Windows events are missing

Possible causes:

• The Azure Monitor Agent is not configured correctly.
• The data collection rule does not target the intended machine.
• The collection level excludes the expected events.
• Azure Arc requirements have not been met for an external server.

Solution: Verify the machine's connectivity, agent status, data collection rule, and event selection.

Problem 5: The analytics rule does not generate an incident

Possible causes:

• The query returns no results.
• The rule has not reached its scheduled execution time.
• The alert or incident creation settings are incorrect.
• The selected data source is not populated.

Solution: Run the query manually, confirm that it returns data, and review the rule's scheduling and alert settings.

Problem 6: Azure costs are increasing

Possible causes:

• Too many logs are being ingested.
• The collection rule is too broad.
• Other Azure resources remain active.
• Retention or automation features incur additional charges.

Solution: Review ingestion volume, narrow collection to necessary events, monitor billing, and remove unnecessary lab resources after completing your exercises.

17. Microsoft Sentinel Pricing and Cost Management

Microsoft Sentinel has a pricing model based on data ingestion, data tiers, retention, and selected features. Other Azure resources can generate separate charges.

Microsoft documents a 31-day free trial for eligible usage, covering the first 10 GB per day of eligible Analytics log ingestion, subject to the trial's terms and limits. Additional services or usage outside those limits may still be charged.

Before connecting Windows machines, firewalls, or multiple data sources, review the pricing details.

Official pricing guide:

https://learn.microsoft.com/en-us/azure/sentinel/billing

Cost-control checklist

• Review your subscription's billing configuration.
• Check current Sentinel and Log Analytics pricing.
• Use Azure Cost Management to monitor spending.
• Configure budget alerts.
• Collect only the data required for your lab.
• Review retention and additional service costs.
• Delete unused lab resources when finished.

Deleting a workspace or resource does not necessarily reverse charges already incurred. Review the relevant billing and retention policies before removing resources.

18. Practical SOC Lab Exercise

Now put the concepts together in a controlled learning environment.

Lab objective

Set up Microsoft Sentinel, collect Azure Activity logs, execute KQL queries, and create a basic detection rule.

Exercise

Task 1: Prepare the environment

Create the Azure resource group and Log Analytics workspace, then enable Microsoft Sentinel.

Task 2: Configure a data connector

Install the Azure Activity solution and configure the connector for the appropriate subscription.

Task 3: Generate activity

Perform a harmless, authorized operation in your test environment.

Task 4: Verify ingestion

Run:

AzureActivity
| where TimeGenerated > ago(24h)
| take 50

Task 5: Analyze the events

Run:

AzureActivity
| where TimeGenerated > ago(24h)
| summarize TotalEvents = count() by OperationName
| order by TotalEvents desc

Task 6: Create a detection rule

Create the demonstration analytics rule from Step 10. Confirm that it returns the expected results and understand why it is not suitable for production threat detection.

Task 7: Document your findings

Write down:

• The data source you connected.
• The table receiving the events.
• The queries you executed.
• The events you observed.
• The rule you configured.
• Any problems and how you resolved them.

Expected learning outcomes

After completing this exercise, you should understand how to:

• Provision a Microsoft Sentinel workspace.
• Connect a supported cloud log source.
• Verify ingestion.
• Write basic KQL queries.
• Configure a simple analytics rule.
• Investigate security events.
• Identify common configuration and cost issues.
• 
  

19. Career Opportunities After Learning Microsoft Sentinel

Microsoft Sentinel is relevant to several cybersecurity roles, particularly in security operations.

Potential career paths include:

SOC Analyst: Monitors alerts, reviews security events, and investigates incidents.

Security Analyst: Analyzes threats, evaluates security controls, and supports incident response.

SIEM Engineer: Designs and maintains log collection, detection rules, and SIEM integrations.

Threat Hunter: Searches for suspicious activity using security telemetry and analytical techniques.

Cloud Security Analyst: Investigates cloud activity, identity risks, and misconfigurations.

Security Automation Engineer: Develops workflows to automate selected detection and response processes.

Learning Sentinel alone does not guarantee a job. Stronger candidates also develop networking, Windows administration, identity security, incident response, KQL, and practical investigation skills.

Microsoft provides additional training through its official learning platform:

https://learn.microsoft.com/en-us/training/

20. Conclusion

Microsoft Sentinel is a valuable platform for learning modern cloud security monitoring and SIEM operations.

The best way to learn it is through practical exercises. Start by creating a Log Analytics workspace, enabling Sentinel, connecting Azure Activity logs, and verifying that data is arriving. Then progress to Windows security events, KQL queries, analytics rules, and incident investigations.

Remember that a successful installation is only the beginning. Effective security monitoring requires relevant data, carefully designed detections, proper investigation, and controlled response procedures.

Recommended next step: Complete the Azure Activity lab first. Once it works reliably, add Windows Security Events through Azure Monitor Agent and begin practicing SOC investigation scenarios.