Microsoft Adds Agentic AI Capabilities to Sentinel

Microsoft has previewed Agentic AI capabilities for its Sentinel SIEM, expanding Sentinel into a broader security operations and management platform with new graph capabilities and a Model Context Protocol (MCP) server. The new graph tools will allow Security Copilot agents to investigate and respond to threats more precisely and rapidly, while the Sentinel MCP Server enables integration of third‑party and internally developed agents.

According to Microsoft corporate VP for security Vasu Jakkal in a blog post, Sentinel MCP server enables extensibility for pre-defined and custom agents, shifting security from reactive to predictive and helping teams automate responses at scale. The release also marks closer integration with agents and other security platforms through the Microsoft Security Store, with early partners including Accenture, Darktrace, IBM, Illumio, ServiceNow, Simbian and Zscaler. Microsoft’s Sentinel graph and MCP server are now in public preview, and Sentinel Data Lake remains generally available after its July preview.