Delete installed Microsoft Sentinel out-of-the-box content and solutions

If you installed an out-of-the-box solution, you can remove content items or delete the solution. To restore deleted content items, select Reinstall on the solution. You can also restore the solution by reinstalling it.

Important

After March 31, 2027, Microsoft Sentinel will no longer be supported in the Azure portal and will be available only in the Microsoft Defender portal. All customers using Microsoft Sentinel in the Azure portal will be redirected to the Defender portal and will use Microsoft Sentinel in the Defender portal only.

If you're still using Microsoft Sentinel in the Azure portal, we recommend that you start planning your transition to the Defender portal to ensure a smooth transition and take full advantage of the unified security operations experience offered by Microsoft Defender.

Delete content items

Delete content items from a solution you installed from the content hub.

  1. Open the content hub.

    • Defender portal: Select Microsoft Sentinel > Content management > Content hub.
    • Azure portal: Under Content management, select Content hub.
  2. Select an installed solution with version 2.0.0 or higher.

  3. On the solutions details page, select Manage.

  4. Select the content item or items you want to delete.

  5. Select Delete.

    Screenshot of solution with content items selected for deletion.

To restore deleted content items, select Reinstall on the solution.

Delete the solution

Delete a solution and its content templates from the content hub or the manage solution view. This action doesn't delete active, cloned, saved, or custom items.

  1. In the content hub, select an installed solution.

  2. On the solutions details page, select Delete.

  3. Select Yes to delete the solution and the templates.

    Screenshot of the confirmation prompt to delete the solution.

To restore an out-of-the-box solution from the content hub, select the solution and Install.