Functions: Legacy Category and Load to Editor Issues

Question

Hello all!

I have observed two unsettling behaviours when navigating Microsoft Sentinel through the Portal.

1. I no longer see Legacy Category when trying to select Group By on Functions. Only Solution and Category. I am still able to add a Legacy Category when saving a function, I just cannot group by them.
2. When choosing Load to Editor for a function, instead of opening the function and being able to edit or save it, it just throws the function code at the end of my current KQL code and does not open the function. If i want to change it i have to create a new tab, load the function , change it and save as with the same name so it overwrites.

Both of these are very very unexpected and i cannot find any official documentation about it.

Any insights would be greatly appreciated!

Answer 1

Hi Panagiotis,

The second behavior is documented and expected — it is the "load into an empty query" rule that is easy to miss. The first looks like an undocumented UI change and is worth reporting.

On "Load the function code":

The Functions pane has two distinct actions. "Use in editor" (or double-clicking the function name) inserts a call to the function into your current query. "Load the function code" pastes the function's body into the current query in the editor. Microsoft's documentation states that the function name is only attached to the tab — and the Edit function details option only becomes available — when you load the code into an empty query or onto the first line of an existing query. If you load it below existing KQL, the editor treats it as ordinary query text, which is exactly the behavior you are seeing.

So the documented editing workflow is:

1. Open a new, empty query tab.

2. Hover the function in the Functions pane and select Load the function code.

3. Make your changes, then Save.

4. Select Edit function details to change the name, legacy category, or parameters, then Save again.

That is the same number of clicks as before — the difference is that the tab must start empty. You should not need the "save as with the same name to overwrite" workaround.

Worth checking: editing a function requires microsoft.operationalinsights/workspaces/savedSearches/write on the workspace (Log Analytics Contributor or equivalent). If you only hold read permissions, the editor will silently behave like a read-only paste.

On "Legacy category" disappearing from Group by:

Legacy category still exists as a function property — the Save as function dialog still exposes it, and Microsoft still documents it as a "user-defined category to help filter and group functions." What appears to have changed is only the Group by choices in the Functions pane, which now offer Solution and Category. There is no documentation or announcement for that change that I can find, so it looks like an unannounced portal update rather than a deprecation of the property itself.

Two practical suggestions: use the Filter or Search box in the Functions pane as an interim workaround, and raise this through Azure portal feedback (or a support case if it is blocking a workflow) so it gets tracked. It is also worth confirming whether the same grouping is available in the Defender portal experience, since Microsoft Sentinel in the Azure portal is scheduled for retirement on 31 March 2027 and functionality is progressively consolidating there.

References

• Functions in Azure Monitor log queries (view, use, create, load function code, edit, permissions)

• Use queries in Azure Monitor Log Analytics

• What is Microsoft Sentinel? — Azure portal retirement timeline

• Use Microsoft Sentinel custom functions in advanced hunting in Microsoft Defender