Edit

Share via

Delete installed Microsoft Sentinel out-of-the-box content and solutions

  • Applies to: Microsoft Sentinel in the Microsoft Defender portal, Microsoft Sentinel in the Azure portal

If you installed a Microsoft Sentinel out-of-the-box solution, you can remove content items from the solution or delete the installed solution. If you later need to restore deleted content items, select Reinstall on the solution. Similarly, you can restore the solution by reinstalling the solution.

Important

Microsoft Sentinel is generally available in the Microsoft Defender portal, including for customers without Microsoft Defender XDR or an E5 license.

Starting in July 2026, all customers using Microsoft Sentinel in the Azure portal will be redirected to the Defender portal and will use Microsoft Sentinel in the Defender portal only. Starting in July 2025, many new customers are automatically onboarded and redirected to the Defender portal.

If you're still using Microsoft Sentinel in the Azure portal, we recommend that you start planning your transition to the Defender portal to ensure a smooth transition and take full advantage of the unified security operations experience offered by Microsoft Defender. For more information, see It’s Time to Move: Retiring Microsoft Sentinel’s Azure portal for greater security.

Delete content items

Delete content items for an installed solution deployed by the content hub.

  1. For Microsoft Sentinel in the Defender portal, select Microsoft Sentinel > Content management > Content hub. For Microsoft Sentinel in the Azure portal, under Content management, select Content hub.

  2. Select an installed solution where the version is 2.0.0 or higher.

  3. On the solutions details page, select Manage.

  4. Select the content item or items you want to delete.

  5. Select Delete.

    Screenshot of solution with content items selected for deletion.

To restore deleted content items, select Reinstall on the solution.

Delete the solution

Delete a solution and the related content templates from the content hub or in the manage solution view. Active, cloned, saved, or custom items associated with a content template aren't deleted.

  1. In the content hub, select an installed solution.

  2. On the solutions details page, select Delete.

  3. Select Yes to delete the solution and the templates.

    Screenshot of the confirmation prompt to delete the solution.

To restore an out-of-the-box solution from the content hub, select the solution and Install.