MC1077861 High Major change
(Updated) Microsoft Defender for Cloud Apps: SIEM agents will retire
Summary AI-generated
Retirement of SIEM agents for Microsoft Defender for Cloud Apps is paused; no new SIEM agents can be configured after June 19, 2025. Transition to supported APIs for continued access.
Suggested actions AI-generated
- Plan migration from SIEM agents to supported APIs
- Stop configuring new SIEM agents after June 19, 2025
Written by Azure OpenAI (gpt-4.1) from the text of the post below. It can be incomplete or wrong; the original post is authoritative.
Similar posts
Search for more like this- MC1254554 Upcoming retirement of select threat detections in Microsoft Defender for Cloud Apps
- MC1220762 (Updated) Retirement notice: MDE and XDR Advanced Hunting APIs retiring; migrate to Microsoft Graph Security API
- MC1462464 Microsoft Defender for Cloud Apps: App Governance support for the Cloud Application Administrator role is being retired
- MC1192257 (Updated) Microsoft Defender Threat Intelligence: Convergence with Microsoft Defender and Microsoft Sentinel
- MC1275311 (Updated) Simplifying agent management with Agent 365
- MC1381122 Microsoft Defender XDR: Retirement of in-app OS update notifications in Defender for Endpoint (iOS)
Original post from Microsoft
Updated December 23, 2025: We have paused rollout of this feature. We will announce via Message center when we are ready to proceed. Thank you for your patience.
As part of our ongoing convergence process for all Microsoft Defender workloads, we planned to retire SIEM (Security Information and Event Management) agents from Microsoft Defender for Cloud Apps in late December 2025 (previously mid-November) and ending early January 2026 (previously late November 2025). We have puased this release and will communicate via Message center when we are ready to proceed.
We recommend you transition to APIs that support the management of activities and alerts data from multiple workloads.
[How this will affect your organization:]
Existing Microsoft Defender for Cloud Apps SIEM agents will function as is until the SIEM agents retire, but no new SIEM agents can be configured starting June 19, 2025. Microsoft Sentinel agents will remain supported and can still be added.
Defender for Cloud Apps alerts and activities data currently supported in the SIEM agents are also available in the unified API and SIEM solutions that provide access to alerts and activity data for all Microsoft security products, for cross-workload visibility:
- For alerts and activities, Defender XDR streaming API: Stream Microsoft Defender XDR events - Microsoft Defender XDR | Microsoft Learn
- For Microsoft Entra ID Protection login events: IdentityLogonEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn
- For alerts, Microsoft Graph security alerts API (v2): List alerts_v2 - Microsoft Graph v1.0 | Microsoft Learn
- We also recommend viewing Defender for Cloud Apps alerts data in the Microsoft Defender XDR incidents API. Learn more: Microsoft Defender XDR incidents APIs and the incidents resource type - Microsoft Defender XDR | Microsoft Learn
These APIs enhance security monitoring and management and offer additional supported capabilities that utilize data from multiple Microsoft Defender workloads.
[What you need to do to prepare:]
To ensure continuity and access to the same data available before this retirement through Microsoft Defender for Cloud Apps SIEM agents, we recommend transitioning to the supported unified API and SIEM solutions. We encourage you to begin planning your migration to these solutions to take advantage of their enhanced capabilities.
Learn more: Generic SIEM integration - Microsoft Defender for Cloud Apps | Microsoft Learn
Additional details from Microsoft
- Summary
- Microsoft Defender for Cloud Apps will retire SIEM agents, with no new agents configurable after June 19, 2025. The rollout is paused, and users are advised to transition to unified APIs and SIEM solutions for alerts and activity data to ensure continuity and enhanced capabilities.