How to delete tables from sentinel?

Question

How to delete tables from sentinel?

Alexandra Shalman 0

Hi,

How do I delete the entire table from sentinel?

In order not to pay for retantion?

Thanks

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-02-18T09:28:53.91+00:00
Hello Alexandra Shalman,

In Microsoft Sentinel, tables cannot be deleted individually. They are part of the Log Analytics workspace and are automatically created when data is ingested.

As per Microsoft documentation, if you remove Microsoft Sentinel from the Log Analytics workspace, all Sentinel-related tables are removed and will no longer be accessible. This process may take some time to complete. However, if data is still being sent to the workspace from other sources, charges may continue based on ingestion and retention.

To avoid retention charges, you can:

Stop data ingestion from the connector or resource sending data (via Sentinel Data connectors, Diagnostic settings, or Data Collection Rules)

Reduce the table retention period to the minimum allowed value

Remove Microsoft Sentinel from the workspace if it is no longer needed

Delete the Log Analytics workspace if you want to completely remove all data

Once ingestion is stopped and the retention period expires, the data will be automatically removed.

Hope this helps! Feel free to reach out for further queries.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-02-19T07:56:22.3533333+00:00

Hello Alexandra Shalman,

Could you confirm if you have any further queries on this?

1 answer

Your answer

Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-02-18T09:28:53.91+00:00

Hello Alexandra Shalman,

In Microsoft Sentinel, tables cannot be deleted individually. They are part of the Log Analytics workspace and are automatically created when data is ingested.

As per Microsoft documentation, if you remove Microsoft Sentinel from the Log Analytics workspace, all Sentinel-related tables are removed and will no longer be accessible. This process may take some time to complete. However, if data is still being sent to the workspace from other sources, charges may continue based on ingestion and retention.

To avoid retention charges, you can:

Stop data ingestion from the connector or resource sending data (via Sentinel Data connectors, Diagnostic settings, or Data Collection Rules)

Reduce the table retention period to the minimum allowed value

Remove Microsoft Sentinel from the workspace if it is no longer needed

Delete the Log Analytics workspace if you want to completely remove all data

Once ingestion is stopped and the retention period expires, the data will be automatically removed.

Hope this helps! Feel free to reach out for further queries.
Sridevi Machavarapu 33,820 Reputation points Microsoft External Staff Moderator

2026-02-19T07:56:22.3533333+00:00

Hello Alexandra Shalman,

Could you confirm if you have any further queries on this?

Answer 1

To delete tables from Microsoft Sentinel, you need to remove Microsoft Sentinel from your Log Analytics workspace. When you do this, all Microsoft Sentinel tables will be deleted, and the data in these tables will no longer be accessible or queryable. However, it's important to note that the data retention policy set for those tables will still apply, meaning if you re-enable Microsoft Sentinel within the data retention period, the retained data can be restored.

If your goal is to avoid paying for retention, ensure that you remove Microsoft Sentinel after the retention period has passed, as this will help minimize costs associated with data retention.

References: