Update Exchange Script for Azure Log Monitor Compatibility

[nlepagnez]

Required items, please complete

Change(s):

• ESI Script update to 8.0.0.0 adding Log Monitor Compatibility
• Data Connector Description update to add Warning on Migration to Log Monitor
• Readme files updates to add Log Monitor Migration procedure
• Azure Deploy Template for DCE/DCR/Table creation

Reason for Change(s):

• Depreciation of Log Analytics API

Version Updated:

• No Detections/Analytic Rule update

Testing Completed:

• Yes

Checked that the validations are passing and have addressed any issues that are present:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Microsoft Exchange Security (Online + On-Premises) Sentinel solutions to support migration from the legacy Log Analytics HTTP Data Collector API to the Azure Monitor Log Ingestion pipeline (DCE/DCR), including template, connector UX messaging, and expanded migration documentation.

Changes:

• Bumps solution/data connector versions to 4.0.0 / 2.0.0 and updates connector UI text to guide migration.
• Adds an ARM deployment template for DCE/DCR + custom tables, plus extensive migration/setup docs.
• Updates multiple readmes/parameter docs to describe the new Log Ingestion API configuration and procedures.

Reviewed changes

Copilot reviewed 36 out of 44 changed files in this pull request and generated 15 comments.

Show a summary per file

File	Description
Solutions/Microsoft Exchange Security - Exchange Online/ReleaseNotes.md	Adds 4.0.0 release note entry for Azure Monitor API migration.
Solutions/Microsoft Exchange Security - Exchange Online/Package/mainTemplate.json	Version bumps, connector display text updates, new migration messaging, and ARM/API version updates for savedSearches.
Solutions/Microsoft Exchange Security - Exchange Online/Data/Solution_MicrosoftExchangeSecurityExchangeOnline.json	Bumps solution version to 4.0.0.
Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/azuredeploy_ESI_LogIngestionAPI.json	New ARM template to deploy DCE/DCR/custom tables for Log Ingestion API.
Solutions/Microsoft Exchange Security - Exchange Online/Data Connectors/ESI-ExchangeOnlineCollector.json	Adds migration warning/customs and new “Deploy DCE/DCR” step; bumps connector version.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/README.md	Updates collector version to 8.0.0.0 and adds migration/upgrade guidance.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/Parameters.md	Updates parameter schema docs to v3.0 and documents Log Ingestion API settings.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/OnlineDeployment/README.md	Adds 8.0.0.0 changelog notes including Log Ingestion API support.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/CollectExchSecInsVersionTracking.json	Updates raw repository URL used by version tracking.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Solutions/ESICollector/Beta/CollectExchSecInsVersionTracking.json	Updates beta “LatestVersion” to 8.0.0.0 and repository URL.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/WinformConfigReadme.md	New documentation for WinForms config editor.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/README_LogIngestionAPI.md	New deployment guide for DCE/DCR/table ARM template and ingestion.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/README_AzureMonitorSetup.md	New end-to-end Azure Monitor setup guide (identity, RBAC, validation).
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/README.md	Updates documentation index, linking to new public content/docs.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/README-ForwarderPickup.md	New forwarder/pickup processor documentation.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/QUICKSTART-Forwarder.md	New forwarder quickstart guide.
Solutions/Microsoft Exchange Security - Exchange Online/# - General Content/Documentations/Migrate_From_LogAnalyticsAPI_To_LogIngestionAPI.md	New migration playbook from legacy API to Log Ingestion API.
Solutions/Microsoft Exchange Security - Exchange On-Premises/ReleaseNotes.md	Adds 4.0.0 release note entry for Azure Monitor API migration.
Solutions/Microsoft Exchange Security - Exchange On-Premises/Package/mainTemplate.json	Version bumps, connector messaging, and ARM/API version updates for savedSearches.
Solutions/Microsoft Exchange Security - Exchange On-Premises/Data/Solution_MicrosoftExchangeSecurity.json	Bumps solution version to 4.0.0.
Solutions/Microsoft Exchange Security - Exchange On-Premises/Data Connectors/ESI-ExchangeOnPremisesCollector.json	Adds migration warning/customs and new “Deploy DCE/DCR” step; bumps connector version.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/README.md	Updates collector version to 8.0.0.0 and adds migration/upgrade guidance.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/Parameters.md	Updates parameter schema docs to v3.0 and documents Log Ingestion API settings.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/OnlineDeployment/README.md	Adds 8.0.0.0 changelog notes including Log Ingestion API support.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/CollectExchSecInsVersionTracking.json	Updates raw repository URL used by version tracking.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/Beta/CollectExchSecInsVersionTracking.json	Updates beta “LatestVersion” to 8.0.0.0 and repository URL.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/WinformConfigReadme.md	New documentation for WinForms config editor.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/README_LogIngestionAPI.md	New deployment guide for DCE/DCR/table ARM template and ingestion.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/README_AzureMonitorSetup.md	New end-to-end Azure Monitor setup guide (identity, RBAC, validation).
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/README.md	Updates documentation index, linking to new public content/docs.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/README-ForwarderPickup.md	New forwarder/pickup processor documentation.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/QUICKSTART-Forwarder.md	New forwarder quickstart guide.
Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Documentations/Migrate_From_LogAnalyticsAPI_To_LogIngestionAPI.md	New migration playbook from legacy API to Log Ingestion API.

Comments suppressed due to low confidence (1)

Solutions/Microsoft Exchange Security - Exchange On-Premises/# - General Content/Solutions/ESICollector/CollectExchSecInsVersionTracking.json:1

• Same mismatch as the Online solution: documentation indicates 8.0.0.0, but version tracking still reports 7.6.0.1. Update LatestVersion (and history/date) if 8.0.0.0 is now the intended current release, or explicitly document that it is not yet generally available.

[nlepagnez]

Reviewed

[nlepagnez]

@v-atulyadav, @v-shukore, I see that there is a failing check on KQL validation, but we didn't change anything on this PR concerning the solution, only Text changes and PowerShell script changes. Why this failure ?

Notes that all the errors are outside the solution modified.