Skip to main content
The Content Management Center (CMC) is where detection content lives before it reaches a customer. Rules are stored in repositories, versioned as they change, deployed to the workspaces you choose, and continuously compared against what is actually running. It replaces the pattern of editing rules directly in each Microsoft Sentinel or Microsoft Defender XDR tenant, where the only record of a change is the change itself.

​
What a repository gives you

One source of truth

A rule has one definition and a version history. Every workspace running it is running a known version, not a copy that someone edited in place.

Deployment you control

Choose which workspaces a repository covers, deploy a rule to some or all of them, and roll back to an earlier version.

Drift detection

Scan a workspace and CMC reports the rules that no longer match the baseline, so an edit made in a vendor console does not stay invisible.

Review before change

Turn on protection and edits stop committing directly. They collect as work in progress, get bundled into a change request, and require approval.

​
The one rule that shapes everything else

A repository’s rule set is its baseline. Baseline protection is either on or off, and that single setting changes how every change behaves.

Require change requests off

A change hits the baseline immediately as a new version. Fast, and appropriate for a repository one person maintains.

Require change requests on

Additions, edits, removals, imports and marketplace pulls all become work-in-progress items instead. Nothing changes until one is added to a change request, approved, and merged.
Everything in Change requests follows from that. If you are wondering why your edit did not appear in the rule list, protection is almost always the answer.

​
Supported platforms

CMC manages two rule platforms, and a repository can hold both. Each rule carries its platform, and the platform decides how the rule is validated, where its query runs, and which target it deploys to. See Sentinel and Defender.

​
How the pieces fit

Content enters a repository three ways: pulled from the Marketplace, imported from a workspace that already runs it, or authored from scratch. It leaves through a deployment. The drift scan closes the loop by reading back what is really running.

​
Where to start

Create a repository

Set one up, choose the workspaces it covers, and configure protection.

Add rules

Import from a workspace, pull from the marketplace, or write your own.

Track coverage and drift

See what each workspace is running and reconcile what does not match.

Review changes

Work in progress, change requests, approvals, and merges.

​
Permissions

Access is governed by three organizational content permissions. The practical split: a Content Operator can change content, a Content Admin can change the rules about how content is changed.