Retirement Announcement: Assigning alert trigger playbooks within Microsoft Sentinel analytics rules

Assigning playbooks within Microsoft Sentinel analytic rules will continue to work with full support until it's officially removed on 15 March 2026. After the removal, the feature or capability will no longer work.

Generally Available as of December 2022, customers will be able to assign alert trigger playbooks to analytic rules only using automation rules using "when an alert is created" trigger. It provides the same capabilities as the legacy feature, with the addition of central management for all automation types, ability to control executions order and health monitoring capabilities.

Required action

Check whether you have alert trigger playbooks assigned to analytic rules in analytics rules creation wizard under Automated response – Alert automation (classic). Migrate your Microsoft Sentinel alert-trigger playbooks to automation rules. No update to the playbook itself is needed.

Help and support

If you have questions, get answers from community experts in Microsoft Q&A.