Home
Services
Microsoft Sentinel

Microsoft Sentinel microsoft.com

Is Microsoft Sentinel down right now? Live status and outage tracker

No, Microsoft Sentinel is up.

No outage detected, and no user reports in the last hour.

Live Updated 2 min ago Data refreshes every 5 minutes

Not working for you? Official status pageStatus page

User reports, last 24 hours, 15 minutes a segment: 96 flowing 0 slow (elevated) 0 jammed (outage)

User reports, last 24 hours

No reports in this window

No problem reports came in for Microsoft Sentinel in the last hour, and at this time of day there are usually almost none. There has been no spike in reports since 5 October.

Around the world right now: normal in 49 other countries. By country

NormalClose to the usual level24 h · 0 reports
ElevatedMore than 1.5 times the usual levelNone in this chart
OutageMore than twice the usual level and far above the day's averageNone in this chart
Usual levelWhat a usual day sees at that timeAlmost none at this time of day

Reports, last hour

Quiet

Uptime, 24 h

100.00%

No outage windows

Last outage

None

In the last 24 hours

Busiest 15 minutes

No reports

Last 24 hours

Microsoft Sentinel outages and problems

No user reports came in for Microsoft Sentinel in the past 24 hours, and its uptime over that window is 100.00%.

No 15-minute window had any reports at all, so the chart above stays flat.

No problems detected in the last 24 hoursReports for Microsoft Sentinel stayed at their usual level the whole time.

This month

Microsoft Sentinel in November 2026

Problem reports in November: 0

Monthly report for November 2026

People who report a problem with Microsoft Sentinel to the outage-report feed behind this page can tag what is affected. These are the categories they can pick; the feed shows no counts per category:

Website
Login
App

World map

Microsoft Sentinel reports around the world

In the last 24 hours, 0 problem reports about Microsoft Sentinel came in from 0 countries. Right now reports are at the usual level in every country.

Country	Now	Last hour	24 hours
The US	Normal	0	0
The UK	Normal	0	0
The UAE	Normal	0	0
South Africa	Normal	0	0
Singapore	Normal	0	0
The Philippines	Normal	0	0
Pakistan	Normal	0	0
New Zealand	Normal	0	0
Ireland	Normal	0	0
India	Normal	0	0
Hong Kong	Normal	0	0
Croatia	Normal	0	0

Each country's status compares its reports with the usual level there. 37 more countries had 0 reports in the last 24 hours.

Last 30 days

Microsoft Sentinel problem spikes, last 30 days

Since 5 October, Microsoft Sentinel had no outage spikes or periods of elevated reports.

By country

Each square is one day in the countries with the most reports: red when reports stayed at outage level for half an hour or more, amber when they stayed above the usual level for an hour or more, grey otherwise.

The UAE0
Argentina0
Austria0
Australia0
Belgium0
Brazil0
Canada0
Chile0

Country history starts on 29 October 2026. Days run from midnight to midnight, Central European time.

A spike is a sharp rise in problem reports from users, kept exactly as this page showed it at the time. This history starts on 5 October 2026. Monthly reports for all services

Troubleshooting

How to fix Microsoft Sentinel not working

Microsoft Sentinel is up on our end, so if it won't work for you, the problem is most likely on your side. Work through these in order:

Your browser tries to reach microsoft.com over your own connection, right now. Nothing is sent to us or stored.

Check the workspace and permissions
Open the Azure portal and go to Microsoft Sentinel. Pick the workspace tied to your subscription or tenant, then check your role under Access control (IAM); the Microsoft Sentinel Reader role lets you view incidents and logs, while Contributor lets you change rules and connectors.
Reconnect the data connector
In the service, open Configuration > Data connectors and select the connector that feeds your logs. Read the status line; if it says disconnected or shows no recent data, rerun the connector setup and confirm the credentials and API permissions.
Query the logs for recent events
Open Logs in the workspace and run a simple query for the table your connector writes to, such as SecurityEvent, CommonSecurityLog, SigninLogs, or AzureActivity. A query that returns no rows in a recent time range points to ingestion or the connector, so check workspace usage and the connector status again.
Trace the automation rule and playbook
If incidents show up but a playbook does not run, open Configuration > Automation and check the automation rule condition and playbook action. Then open the Logic App run history. Permission errors or expired API connections stop the flow.

While Microsoft Sentinel is down: what to use instead

Logs in the Log Analytics workspace Your Sentinel data lives in the underlying Log Analytics workspace, so you can open Logs in the Azure portal and run your KQL hunting queries there when the Sentinel blades won't load.
Microsoft Defender portal If your workspace is onboarded to the unified security operations platform, the Defender portal shows your incidents and advanced hunting, which helps when only the Azure portal view is failing.
PowerShell or the REST API When the portal hangs, the Az.SecurityInsights module can still list and update incidents.
Azure Monitor log alerts A few log search alert rules on the same workspace, wired to an action group, can keep paging your team if analytics rules stop firing for a while.

Your device

Fix Microsoft Sentinel on Windows, Mac, Android and iPhone

Microsoft Sentinel on Windows

Fix: Clear your browser cache, disable conflicting extensions, or check your local firewall settings to ensure traffic to Azure portal and Microsoft Sentinel endpoints is allowed.
Check: Check the Azure Service Health dashboard in your browser or look for active service alerts affecting Microsoft Sentinel in your Azure tenant.

Command Prompt

ping microsoft.comTest whether Microsoft Sentinel's servers reply

nslookup microsoft.comCheck that Microsoft Sentinel's DNS resolves

tracert microsoft.comTrace where the connection drops

ipconfig /flushdnsClear the DNS cache, then reload

Microsoft Sentinel on Mac

Fix: Try using an incognito window in Safari or Chrome, or verify that your macOS network security settings are not blocking Microsoft Sentinel's cloud domains.
Check: Visit the official Azure Status page on your Mac to see if there is a regional outage affecting Microsoft Sentinel services.

Terminal

ping -c 4 microsoft.comTest whether Microsoft Sentinel's servers reply

nslookup microsoft.comCheck that Microsoft Sentinel's DNS resolves

traceroute microsoft.comTrace where the connection drops

sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderFlush the macOS DNS cache, then reload

Microsoft Sentinel on Android

Fix: Clear the cache of the Azure mobile app or update it via the Google Play Store to resolve connection issues with Microsoft Sentinel.
Check: Open the Azure mobile app on Android and check the Service Health section to see if Microsoft Sentinel is experiencing disruptions.

Microsoft Sentinel on iPhone and iPad

Fix: Force-close and restart the Azure app on your iPhone or iPad, or reinstall the app from the App Store to fix Microsoft Sentinel access issues.
Check: Use the Azure app for iOS or Safari to check the Azure Status page for any active incidents related to Microsoft Sentinel.

About

What happens when Microsoft Sentinel goes down

Microsoft Sentinel is a cloud-native SIEM and SOAR platform that security operations teams use to collect logs, detect threats, automate responses, and coordinate investigations. An outage interrupts data ingestion and incident creation, then stalls hunting queries and playbooks.

During an outage, connectors may stop sending logs to the workspace, so new events do not appear in hunting queries or workbooks. Analytics rules can fail to evaluate, which means incidents do not generate even when matching events arrive; automation rules and playbooks then have nothing to trigger. The first signs often show in ingestion delays or missing incidents, while dashboards refresh with stale data. Problems are frequently partial or regional, affecting one workspace or one region while other parts of the service continue.

Servers and network

Microsoft Sentinel IP address, servers and network

IPv4 address: 23.52.181.212
IPv6 addresses: 2a02:26f0:3100:181::356e
Show all 5
2a02:26f0:3100:187::356e
2a02:26f0:3100:18c::356e
2a02:26f0:3100:18e::356e
2a02:26f0:3100:1a3::356e
Network: AS16625 · Akamai Technologies, Inc., registered in the United States
Served through: Microsoft Azure Front Door
DNS hosted by: Microsoft Azure DNS
HTTPS certificate: Issued by Microsoft Corporation, valid until 30 Jan 2027 (90 days)
HTTP/3: Not advertised
Our check: Answered in 250 ms

Checked from our server in Frankfurt, Germany, 2 days ago, for www.microsoft.com. A service behind a CDN answers from many data centres, usually the one nearest to you, so these addresses are where its traffic enters, not where its own servers stand. Visitors elsewhere may see different addresses.

Checked from 11 places around the world

None of check-host.net's 11 servers got an answer from www.microsoft.com (connection timed out), but our own check from Frankfurt did, 2 days ago. That usually means the site drops automated checks from those servers, not that it is down.

Checked with check-host.net from 11 cities 2 days ago, for www.microsoft.com.

Questions

Microsoft Sentinel FAQ

Is Microsoft Sentinel down right now?

The status at the top of this page shows whether problem reports for the service are above their usual level, counted in 15-minute windows over the last 24 hours. This site does not ping, probe, poll, or monitor the app itself, and it never checks from multiple locations. If the status is normal, check the official status page, then test from another network or browser, sign out and back in, and try a different workspace or tenant to see whether the problem follows your account.

Why are incidents not appearing after an analytics rule fires?

Check the analytics rule first: if you disabled it or changed its query, the rule creates no incident. A broken data connector can also leave the rule with nothing to match, so open the connector page and confirm logs are arriving. Your role matters too; without the Reader or Contributor role for Microsoft Sentinel on the workspace, you may not see incidents that already exist.

Why does the Microsoft 365 connector show disconnected or stop sending logs?

A Microsoft 365 connector usually stops because of an expired credential or a revoked admin consent. Reauthorize the connector in the data connectors page and confirm the account still has permission to read audit logs. If logs arrive late rather than never, check the workspace ingestion delay before you treat it as an outage.

Why do I get an access denied message when I open Microsoft Sentinel?

Access denied usually points to Azure role assignments rather than a service outage. You need at least Microsoft Sentinel Reader on the workspace, and you may also need Log Analytics Reader to query the underlying tables. Ask a subscription owner to check your role at the workspace scope, then sign out and back in so the portal picks up the change.

Why is my automation rule or playbook not running in Microsoft Sentinel?

Automation rules only run when an incident or alert meets their conditions, so a typo in the condition stops the playbook from firing. The playbook also needs a valid connection and permission to act on the workspace or resource. Open the automation rule run history and the logic app run history to see which step failed.

For your site

Put the Microsoft Sentinel status badge on your site

Paste one of these into a web page, a blog post or a README. The badge shows the same status as this page, based on user problem reports. Browsers can keep a copy for up to 4 hours. It links back here.

HTML

<a href="https://isitdownrightnow.app/services/microsoft-sentinel/"><img src="https://isitdownrightnow.app/badge/microsoft-sentinel.svg" alt="Microsoft Sentinel status" height="20"></a>

Markdown, for README files

[![Microsoft Sentinel status](https://isitdownrightnow.app/badge/microsoft-sentinel.svg)](https://isitdownrightnow.app/services/microsoft-sentinel/)

The badge is a plain image: no scripts, no cookies. People who see it on your page load it from our server.

How we track Microsoft Sentinel

The status on this page comes from user-submitted problem reports for Microsoft Sentinel, counted in 15-minute windows over the last 24 hours. Each window is compared with the normal level for Microsoft Sentinel, so a few complaints on a quiet day don't trigger anything, but a sudden jump well above normal does.

When reports climb well above normal, the status here changes to partial outage or major outage and the chart moves with it. This is separate from Microsoft Sentinel's official status page: user reports tend to show a problem early, while the official page confirms the cause. If the two disagree, check both.