To see Sentinel Alerts and Incidents onboard to Defender Portal by EdB-MSFT · Pull Request #9875 · microsoftgraph/microsoft-graph-docs-contrib

EdB-MSFT · 2026-04-26T09:09:35Z

Important

Required for API changes:

[] Link to API.md file: ADD LINK HERE
[] Link to PR for public-facing schema changes (schema-Prod-beta/v1.0.csdl): ADD LINK HERE
[] Attach the documentation plan generated for AI-assisted docs authoring and validation to help speed up content review.

Add other supporting information, such as a description of the PR changes:

ADD INFORMATION HERE

Important

The following guidance is for Microsoft employees only. Community contributors can ignore this message; our content team will manage the status.

After you've created your PR, expand this section for tips and additional instructions.

do not merge is the default PR status and is automatically added to all open PRs that don't have the ready to merge label.
Add the ready for content review label to start a review. Only PRs that have met the minimum requirements for content review and have this label are reviewed.
If your content reviewer requests changes, review the feedback and address accordingly as soon as possible to keep your pull request moving forward. After you address the feedback, remove the changes requested label, add the review feedback addressed label, and select the Re-request review icon next to the content reviewer's alias. If you can't add labels, add a comment with #feedback-addressed to the pull request.
After the content review is complete, your reviewer will add the content review complete label. When the updates in this PR are ready for external customers to use, replace the do not merge label with ready to merge and the PR will be merged within 24 working hours.
Pull requests that are inactive for more than 6 weeks will be automatically closed. Before that, you receive reminders at 2 weeks, 4 weeks, and 6 weeks. If you still need the PR, you can reopen or recreate the request.

For more information, see the Content review process summary.

learn-build-service-prod · 2026-04-26T09:23:04Z

Learn Build status updates of commit e124b69:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/v1.0/resources/security-api-overview.md	✅Succeeded

For more details, please refer to the build report.

microsoft-github-policy-service · 2026-04-27T08:13:23Z

Thank you for your work in this PR, @@EdB-MSFT.

When the updates in this PR are ready for external customers to use, please replace the do not merge label with ready to merge.

If this PR includes schema-related changes, verify that the updates are visible in the metadata endpoint before merging: https://graph.microsoft.com/beta/$metadata for beta changes, or https://graph.microsoft.com/v1.0/$metadata for v1.0 changes.

Check the content review workflow here.

learn-build-service-prod · 2026-04-27T08:13:24Z

Learn Build status updates of commit cfa2820:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/v1.0/resources/security-api-overview.md	✅Succeeded

For more details, please refer to the build report.

learn-build-service-prod · 2026-04-27T08:21:39Z

Learn Build status updates of commit 63e32f7:

✅ Validation status: passed

File	Status	Preview URL	Details
api-reference/beta/resources/security-api-overview.md	✅Succeeded
api-reference/v1.0/resources/security-api-overview.md	✅Succeeded

For more details, please refer to the build report.

@FaithOmbongi

…s://github.com/microsoftgraph/microsoft-graph-docs-contrib (branch main) (#28731) * add whiteboard extension * JSON Format fix - remove trailing comma * cross-link to parent (#9856) * Update supported source extensions for HTML format * Rename 'Tenant management' to 'Tenants' * Document auto-owner behavior for Agent ID Developer role (#9857) * Document auto-owner behavior for Agent ID Developer role Added notes to the Create agentIdentityBlueprint and Create agentIdentityBlueprintPrincipal API docs explaining that users with the Agent ID Developer role are automatically added as owners of the blueprints and blueprint principals they create. Updated the shared RBAC include (rbac-agentid-apis-write.md) to: - Expand scope to cover blueprints, blueprint principals, and agent identities - Clarify the auto-owner behavior Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review: update auto-owner language, remove redundant notes - Update RBAC include to use 'principal...is assigned ownership' language per reviewer feedback - Remove [!NOTE] blocks from blueprint and blueprint principal create docs (info already in shared RBAC include) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Trigger crlf check; concise --------- Co-authored-by: STALLAMRAJU <swtallamraju@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Fix formatting of known issue in RBAC documentation (#9864) * Fix formatting of known issue in RBAC documentation * Fix formatting of known issue in RBAC documentation * Update change-notifications-delivery-webhooks.md (#9863) * Update change-notifications-delivery-webhooks.md Corrected description of timeout handling. * Update change-notifications-delivery-webhooks.md minor fixes. * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Clarify restore point return limits in documentation (#9865) * Clarify restore point return limits in documentation Updated note about restore point search response limits. * align v1 doc Updated note on restore point search response limits. --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Update example to reflect deleted group objects (#9869) The example request was about groups. So I changed "user objects" to "group objects" to align the example. * Bump actions/checkout from 4 to 6 (#9879) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump NuGet/setup-nuget from 2 to 4 (#9877) Bumps [NuGet/setup-nuget](https://github.com/nuget/setup-nuget) from 2 to 4. - [Release notes](https://github.com/nuget/setup-nuget/releases) - [Commits](NuGet/setup-nuget@v2...v4) --- updated-dependencies: - dependency-name: NuGet/setup-nuget dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/setup-dotnet from 4 to 5 (#9878) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4 to 5. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump azure/login from 2 to 3 (#9876) Bumps [azure/login](https://github.com/azure/login) from 2 to 3. - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@v2...v3) --- updated-dependencies: - dependency-name: azure/login dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * To see Sentinel Alerts and Incidents onboard to Defender Portal (#9875) * To see Sentinel Alerts and Incidents onboard to Defender Portal * Apply suggestion from @FaithOmbongi * Update security-api-overview.md --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Update link-validation-config.json * Update link-validation-config.json --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: kawkaur <kawkaur@microsoft.com_msteamsmdb> Co-authored-by: Danipocket <88507770+Danipocket@users.noreply.github.com> Co-authored-by: Li Dai <daili@microsoft.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> Co-authored-by: Laura Graham <Lauragra@users.noreply.github.com> Co-authored-by: learn-build-service-prod[bot] <113403604+learn-build-service-prod[bot]@users.noreply.github.com> Co-authored-by: Learn Build Service GitHub App <Learn Build Service LearnBuild@microsoft.com> Co-authored-by: swetheendra <31578080+swetheendra@users.noreply.github.com> Co-authored-by: STALLAMRAJU <swtallamraju@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mjfdev84 <276818289+mjfdev84@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ch@ps <61343268+Subham-RKB@users.noreply.github.com> Co-authored-by: marikamiwa <123721875+marikamiwa@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Baynash <105771311+EdB-MSFT@users.noreply.github.com>

@FaithOmbongi

…s://github.com/microsoftgraph/microsoft-graph-docs-contrib (branch main) (#28766) * add whiteboard extension * JSON Format fix - remove trailing comma * cross-link to parent (#9856) * Update supported source extensions for HTML format * Rename 'Tenant management' to 'Tenants' * Document auto-owner behavior for Agent ID Developer role (#9857) * Document auto-owner behavior for Agent ID Developer role Added notes to the Create agentIdentityBlueprint and Create agentIdentityBlueprintPrincipal API docs explaining that users with the Agent ID Developer role are automatically added as owners of the blueprints and blueprint principals they create. Updated the shared RBAC include (rbac-agentid-apis-write.md) to: - Expand scope to cover blueprints, blueprint principals, and agent identities - Clarify the auto-owner behavior Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address review: update auto-owner language, remove redundant notes - Update RBAC include to use 'principal...is assigned ownership' language per reviewer feedback - Remove [!NOTE] blocks from blueprint and blueprint principal create docs (info already in shared RBAC include) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Trigger crlf check; concise --------- Co-authored-by: STALLAMRAJU <swtallamraju@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Fix formatting of known issue in RBAC documentation (#9864) * Fix formatting of known issue in RBAC documentation * Fix formatting of known issue in RBAC documentation * Update change-notifications-delivery-webhooks.md (#9863) * Update change-notifications-delivery-webhooks.md Corrected description of timeout handling. * Update change-notifications-delivery-webhooks.md minor fixes. * Apply suggestions from code review Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Clarify restore point return limits in documentation (#9865) * Clarify restore point return limits in documentation Updated note about restore point search response limits. * align v1 doc Updated note on restore point search response limits. --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * Update example to reflect deleted group objects (#9869) The example request was about groups. So I changed "user objects" to "group objects" to align the example. * Bump actions/checkout from 4 to 6 (#9879) Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 6. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v4...v6) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump NuGet/setup-nuget from 2 to 4 (#9877) Bumps [NuGet/setup-nuget](https://github.com/nuget/setup-nuget) from 2 to 4. - [Release notes](https://github.com/nuget/setup-nuget/releases) - [Commits](NuGet/setup-nuget@v2...v4) --- updated-dependencies: - dependency-name: NuGet/setup-nuget dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump actions/setup-dotnet from 4 to 5 (#9878) Bumps [actions/setup-dotnet](https://github.com/actions/setup-dotnet) from 4 to 5. - [Release notes](https://github.com/actions/setup-dotnet/releases) - [Commits](actions/setup-dotnet@v4...v5) --- updated-dependencies: - dependency-name: actions/setup-dotnet dependency-version: '5' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump azure/login from 2 to 3 (#9876) Bumps [azure/login](https://github.com/azure/login) from 2 to 3. - [Release notes](https://github.com/azure/login/releases) - [Commits](Azure/login@v2...v3) --- updated-dependencies: - dependency-name: azure/login dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * To see Sentinel Alerts and Incidents onboard to Defender Portal (#9875) * To see Sentinel Alerts and Incidents onboard to Defender Portal * Apply suggestion from @FaithOmbongi * Update security-api-overview.md --------- Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> * security-alert onboarding requirements note (#9883) * security-alert onboarding requirements note * Update security-alert.md * Update security-api-overview.md * Update security-api-overview.md --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: kawkaur <kawkaur@microsoft.com_msteamsmdb> Co-authored-by: Danipocket <88507770+Danipocket@users.noreply.github.com> Co-authored-by: Li Dai <daili@microsoft.com> Co-authored-by: Faith Moraa Ombongi <ombongi.moraa.fe@gmail.com> Co-authored-by: Laura Graham <Lauragra@users.noreply.github.com> Co-authored-by: learn-build-service-prod[bot] <113403604+learn-build-service-prod[bot]@users.noreply.github.com> Co-authored-by: Learn Build Service GitHub App <Learn Build Service LearnBuild@microsoft.com> Co-authored-by: swetheendra <31578080+swetheendra@users.noreply.github.com> Co-authored-by: STALLAMRAJU <swtallamraju@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: mjfdev84 <276818289+mjfdev84@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: Ch@ps <61343268+Subham-RKB@users.noreply.github.com> Co-authored-by: marikamiwa <123721875+marikamiwa@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ed Baynash <105771311+EdB-MSFT@users.noreply.github.com>

To see Sentinel Alerts and Incidents onboard to Defender Portal

e124b69

FaithOmbongi self-assigned this Apr 27, 2026

FaithOmbongi added the area: security label Apr 27, 2026

microsoft-github-policy-service Bot requested a review from FaithOmbongi April 27, 2026 08:07

FaithOmbongi reviewed Apr 27, 2026

View reviewed changes

Comment thread api-reference/v1.0/resources/security-api-overview.md Outdated

FaithOmbongi added 2 commits April 27, 2026 11:07

Apply suggestion from @FaithOmbongi

cfa2820

Update security-api-overview.md

63e32f7

FaithOmbongi approved these changes Apr 27, 2026

View reviewed changes

FaithOmbongi added content review complete Apply when the content review is complete on a PR. ready to merge Use this label to indicate to the repository admins that your PR is ready to merge into master. labels Apr 27, 2026

FaithOmbongi enabled auto-merge (squash) April 27, 2026 08:11

FaithOmbongi merged commit 2967a0f into microsoftgraph:main Apr 27, 2026
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

To see Sentinel Alerts and Incidents onboard to Defender Portal#9875

To see Sentinel Alerts and Incidents onboard to Defender Portal#9875
FaithOmbongi merged 3 commits into
microsoftgraph:mainfrom
EdB-MSFT:patch-1

EdB-MSFT commented Apr 26, 2026

Uh oh!

learn-build-service-prod Bot commented Apr 26, 2026

Uh oh!

Uh oh!

microsoft-github-policy-service Bot commented Apr 27, 2026

Uh oh!

learn-build-service-prod Bot commented Apr 27, 2026

Uh oh!

learn-build-service-prod Bot commented Apr 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

EdB-MSFT commented Apr 26, 2026

Uh oh!

learn-build-service-prod Bot commented Apr 26, 2026

✅ Validation status: passed

Uh oh!

Uh oh!

microsoft-github-policy-service Bot commented Apr 27, 2026

Uh oh!

learn-build-service-prod Bot commented Apr 27, 2026

✅ Validation status: passed

Uh oh!

learn-build-service-prod Bot commented Apr 27, 2026

✅ Validation status: passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants