What is IT AMC in Dubai and why do businesses need it?

IT AMC (Annual Maintenance Contract) in Dubai is a comprehensive service agreement for maintaining all IT equipment and systems. Businesses need IT AMC for predictable costs, 24/7 support, preventive maintenance, reduced downtime, and expert technical assistance. It's the most affordable way to ensure reliable IT operations.

How much does IT AMC cost in Dubai?

IT AMC pricing in Dubai depends on the number of devices and users, the coverage tier (remote, on-site, or hybrid), the response-time SLA, and whether servers, network, and cybersecurity are included. We scope every contract to your environment and provide a fixed monthly quote on request, so you get predictable costs with no per-incident surprises.

What is included in managed IT services in Dubai?

Our managed IT services in Dubai include complete IT infrastructure management, 24/7 monitoring and support, cybersecurity, cloud services, backup and disaster recovery, help desk support, network management, and proactive maintenance. It's a complete IT department solution with affordable monthly pricing.

What is the response time for IT support in Dubai?

GR IT Services operates a priority-tiered response SLA for managed and AMC clients: 5 minutes for P1 critical issues, 10 minutes for P2 high-priority tickets, and 30 minutes for P3 medium-priority tickets. We provide 24/7 coverage across all Dubai areas.

Which areas in Dubai does GR IT Services cover?

We provide IT AMC and managed IT services across all Dubai areas including Dubai Internet City, Business Bay, Downtown Dubai, DIFC, Dubai Marina, JLT, Sheikh Zayed Road, Dubai Silicon Oasis, Bur Dubai, and Deira. We also serve Abu Dhabi, Sharjah, Ajman, Ras Al Khaimah, and Fujairah with complete IT support.

Why is GR IT Services the best IT company in Dubai?

GR IT Services is the best IT company in Dubai because we offer affordable prices, reliable 24/7 support, a 5-minute response SLA for critical issues (10 minutes for high-priority, 30 minutes for medium), complete IT solutions, certified Microsoft Partner status, continuous service since 2022, and 68+ satisfied clients. We provide the best IT AMC and managed IT services in Dubai with guaranteed SLA.

Microsoft Sentinel data connectors, UAE

The legacy HTTP Data Collector API stops being supported after 14 September 2026.

Microsoft has published that date and the consequence: data sources, custom integrations and connectors still using it risk ingestion interruptions afterwards. If anything you built is sending data that way, this is the most urgent Sentinel task on your list.

Book a connector migration review See the connector types

Microsoft Sentinel data connectors for UAE organisations

14 Sep 2026Legacy HTTP Data Collector API support ends
31 Mar 2027Sentinel in the Azure portal is retired
4 routesFor building a custom connector
3 support tiersMicrosoft, partner and community

How data gets into Sentinel

Eight things to establish about your own ingestion.

Sentinel is only as good as what reaches it, and most estates have accumulated connectors across several eras of the product. Two of those eras now have published end dates, which makes an inventory more urgent than it has been.

What is still using the legacy API

After 14 September 2026 the legacy HTTP Data Collector API is no longer supported, and Microsoft warns of potential ingestion interruptions afterwards. Anything custom built more than a couple of years ago is a candidate, and the failure mode is data quietly stopping rather than an error somebody sees.

Where that data should go instead

Microsoft recommends transitioning to the Logs Ingestion API or the Codeless Connector Framework, citing uninterrupted ingestion, improved reliability, scalability and long-term support. The choice between them usually depends on whether you are calling an API or receiving a push.

Service to service connectors for Microsoft and AWS

Out of the box service-to-service support integrates in real time. The Defender XDR connector alone brings in data from Office 365, Microsoft Entra ID, Microsoft Defender for Identity and Microsoft Defender for Cloud Apps, which is a substantial amount of coverage from one connection.

Syslog and CEF through the Azure Monitor Agent

Events stream from Linux-based Syslog-supporting devices using the Azure Monitor Agent, installed either on the device or on a dedicated Linux log forwarder. Syslog messages land in the Syslog table and CEF messages in the CommonSecurityLog table, which is worth knowing when writing queries.

Custom logs and custom tables

For some sources you collect logs as files on Windows or Linux machines, and after configuration the data appears in custom tables. That is the route for applications with no API and no Syslog output, which describes a large share of line of business software.

Who supports each connector you rely on

Connectors are Microsoft-supported, partner-supported or community-supported. Community-supported connectors have no listed support contact, and issues are raised in the Microsoft Sentinel GitHub community. Knowing which tier a critical connector sits in matters before it breaks, not after.

Connectors arrive as part of solutions

Deploying a solution from the Content Hub brings the data connector together with related workbooks, analytics rules and playbooks in the same deployment. Installing a connector alone and then wondering why there is no detection content is a common and avoidable step.

The portal move, with its own date

After 31 March 2027, Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal, with customers redirected. That affects runbooks, saved links, documentation and any automation that assumes the Azure portal experience.

The near-term deadline

After 14 September 2026, anything on the legacy HTTP Data Collector API may simply stop arriving.

Microsoft frames it as potential ingestion interruptions, and the reason it deserves attention now is how it fails.

Ingestion stopping is silent. A connector that has worked for three years does not raise an alert when it stops sending, and a Sentinel workspace with one missing source looks identical to one with all its sources until somebody queries a table and finds nothing recent.
The candidates are custom work rather than product connectors: integrations built by a previous supplier, scripts pushing data from a line of business system, and anything written against the older Log Analytics ingestion pattern. Those are exactly the ones nobody has documentation for.
The recommended destinations are the Logs Ingestion API and the Codeless Connector Framework, and Microsoft cites uninterrupted ingestion, improved reliability, scalability and long-term support as the reasons. For most cases the Codeless Connector Framework is the lower-effort route where the source exposes an API.
The practical action is an inventory rather than a migration project. Establish which sources use the legacy API, which are actually still needed, and which can be retired instead of migrated. That last category is usually larger than expected.

Ask us to inventory your connectors

How we approach it

Four things that make ingestion reliable rather than assumed.

A SIEM with a missing source is worse than one you know is incomplete, because it produces confident conclusions from partial data. Almost all of this work is about making incompleteness visible.

We find the legacy API usage before the deadline finds it

After 14 September 2026 the legacy HTTP Data Collector API is unsupported and Microsoft warns of potential ingestion interruptions. The custom integrations using it are rarely documented, so this is an inventory exercise rather than a lookup, and it is worth doing now rather than in September.

We ask what actually uses each source

Sources mapped to the analytics rules and workbooks that consume them, because a source nothing queries is cost without benefit. Migrating it is wasted effort and retiring it reduces both the migration workload and the ongoing ingestion volume.

We add alerting for silence

The characteristic failure of a SIEM connector is that it stops without complaining. Alerting when a source goes quiet turns that into a detected event, and it is the single change that most improves confidence in the data underneath every detection you run.

We install solutions rather than bare connectors

Deploying a solution from the Content Hub brings the connector together with related workbooks, analytics rules and playbooks in one deployment. Connecting a source and then building detection from scratch is a common way to spend weeks recreating content that shipped with the connector.

How an engagement runs

Four phases across roughly four to six weeks.

The inventory usually finds three categories: sources to migrate, sources to retire, and sources everybody assumed were connected and are not.

01
Week 1
Inventory every ingestion path
Not just the connectors page. Custom integrations, scripts, forwarders and anything a previous supplier built. Each one attributed to a source, an owner, an ingestion method and a support tier, since community-supported connectors carry a different risk profile.
- Every ingestion path listed with method and owner
- Legacy HTTP Data Collector API usage identified
- Support tier recorded per connector
- Sources believed connected but silent identified
02
Week 2
Decide migrate or retire, per source
The most valuable question in the engagement. A source that nothing queries and no analytics rule uses does not need migrating, it needs turning off. That decision reduces both the migration effort and the ongoing ingestion volume.
- Sources mapped to analytics rules and workbooks that use them
- Unused sources identified for retirement
- Migration target chosen per remaining source
- Retirement decisions recorded with owners
03
Weeks 3 to 4
Migrate, preferring codeless where it fits
Codeless Connector Framework where the source exposes a suitable API, Logs Ingestion API through an Azure Function or Logic App where custom logic is genuinely needed. Each migration validated by confirming data lands in the expected table before the old path is removed.
- Connectors rebuilt on supported routes
- Data confirmed arriving in the expected tables
- Analytics rules validated against the new data
- Legacy paths decommissioned only after validation
04
Weeks 5 to 6
Add ingestion monitoring and plan the portal move
The step that prevents this recurring: alerting when a source stops sending, so silent ingestion failure becomes a detected event. Alongside it, planning for the Azure portal retirement on 31 March 2027, which affects runbooks and saved links.
- Ingestion health monitoring per source
- Alerting when a source goes quiet
- Runbooks updated for the Defender portal
- Content Hub solutions installed where connectors were standalone

Where this matters

Six situations where ingestion is the problem.

The symptom is usually a detection that should have fired, or an investigation that hit a gap in the data at exactly the wrong moment.

An organisation with integrations built by a previous supplier

Custom ingestion written by somebody no longer engaged, undocumented, and quite possibly using the HTTP Data Collector API that stops being supported after 14 September 2026. This is the highest priority inventory in most Sentinel estates right now.

A business that discovered a gap during an investigation

The worst way to learn a connector broke. Ingestion health monitoring with alerting on silence converts that from an incident-time discovery into a Tuesday morning ticket, which is a substantially better outcome for the same underlying failure.

A regulated firm evidencing log coverage

Auditors ask which sources feed the SIEM and how you know they are still feeding it. An inventory with owners, methods and support tiers answers the first, and ingestion health alerting answers the second in a way a screenshot cannot.

An operator with network and appliance logs

Syslog and CEF from Linux-based devices via the Azure Monitor Agent, either on the device or on a dedicated log forwarder. Knowing that Syslog lands in the Syslog table and CEF in CommonSecurityLog is also what makes the resulting queries work first time.

A company with line of business applications that only write files

No API, no Syslog, just log files on a server. Custom log collection puts that data into custom tables, which is frequently the only route for the application that matters most to the business and integrates with nothing.

An organisation planning data lake retention

The data lake tier behaves differently from the analytics tier and it is worth knowing before ingesting. Specific records cannot be purged from it, it retains data for the defined retention period even if deleted at source, and Purview setting changes do not affect it.

Three positions

How UAE organisations manage Sentinel ingestion.

The right column is more common than it should be, and its defining feature is that nobody knows what stopped working until they need the data.

Every ingestion path known

Inventoried and monitoredYes

Connected, not monitoredMostly

Accumulated over yearsNo

Legacy API usage identified

Inventoried and monitoredYes

Connected, not monitoredUnknown

Accumulated over yearsUnknown

Silent ingestion failure detected

Inventoried and monitoredAlerted

Connected, not monitoredNo

Accumulated over yearsNo

Unused sources retired

Inventoried and monitoredYes

Connected, not monitoredNo

Accumulated over yearsNo

Connectors installed with solutions

Inventoried and monitoredYes

Connected, not monitoredSometimes

Accumulated over yearsRarely

Support tier known per connector

Inventoried and monitoredYes

Connected, not monitoredNo

Accumulated over yearsNo

Sources mapped to analytics rules

Inventoried and monitoredYes

Connected, not monitoredNo

Accumulated over yearsNo

Ready for the September 2026 deadline

Inventoried and monitoredYes

Connected, not monitoredUnknown

Accumulated over yearsUnknown

Ready for the Defender portal move

Inventoried and monitoredPlanned

Connected, not monitoredNot started

Accumulated over yearsNot started

Ingestion volume understood

Inventoried and monitoredYes

Connected, not monitoredPartly

Accumulated over yearsNo

Feature	Inventoried and monitored	Connected, not monitored	Accumulated over years
Every ingestion path known	Yes	Mostly	No
Legacy API usage identified	Yes	Unknown	Unknown
Silent ingestion failure detected	Alerted	No	No
Unused sources retired	Yes	No	No
Connectors installed with solutions	Yes	Sometimes	Rarely
Support tier known per connector	Yes	No	No
Sources mapped to analytics rules	Yes	No	No
Ready for the September 2026 deadline	Yes	Unknown	Unknown
Ready for the Defender portal move	Planned	Not started	Not started
Ingestion volume understood	Yes	Partly	No

Choosing a route

How to get a source into Sentinel, and when each fits.

Most estates end up using several of these. The mistake is defaulting to whichever one the last person used rather than choosing per source.

	Route	Best suited to
Solution from the Content Hub	Anything with an existing connector, since it brings detection content too
Service to service connector	Microsoft services and Amazon Web Services, integrating in real time
Codeless Connector Framework	A source that exposes an API you can poll, with no code to maintain
Logs Ingestion API in an Azure Function	Custom logic, transformation, or authentication the framework cannot express
Logs Ingestion API in a Logic App	Low code integration where an Azure Function is more than you need
Syslog via Azure Monitor Agent	Network and Linux devices, landing in the Syslog table
CEF via Azure Monitor Agent	Security appliances emitting CEF, landing in CommonSecurityLog
Custom logs via the agent	Applications that only write log files, landing in custom tables
Azure Monitor Agent directly or Logstash	Custom connector scenarios outside the above
Legacy HTTP Data Collector API	Nothing, after 14 September 2026

How an engagement runs

Five steps, and the second one saves the most work.

Deciding what not to migrate is the highest leverage decision available, and it requires knowing what actually consumes each source.

1
Inventory every path data takes into the workspace
Product connectors, service to service integrations, agents, forwarders, scripts and anything a previous supplier built. Each attributed to a source, an owner, an ingestion method and a support tier, since community-supported connectors carry no listed support contact.
2
Map sources to what consumes them
Analytics rules, workbooks and hunting queries. A source nothing consumes is ingestion cost with no security benefit, and retiring it is both cheaper and faster than migrating it to a supported ingestion route.
3
Migrate the legacy paths to supported routes
Codeless Connector Framework where the source exposes a suitable API, or the Logs Ingestion API through an Azure Function or Logic App where custom logic is needed. Validated by confirming data lands in the expected table before the legacy path is removed.
4
Add ingestion health monitoring
Alerting when a source stops sending, per source rather than in aggregate. This is what turns the characteristic silent failure of SIEM ingestion into something detected, and it protects every detection built on top of that data.
5
Plan the Defender portal transition
After 31 March 2027 Sentinel is available only in the Microsoft Defender portal, with Azure portal users redirected. Runbooks, saved links, training material and any automation assuming the Azure portal all need updating, and doing it early avoids a rushed change.

Straight answers

What organisations ask about Sentinel data connectors.

After 14 September 2026 the legacy HTTP Data Collector API is no longer supported. Microsoft states that data sources, custom integrations or connectors using it should transition to a supported alternative to avoid potential ingestion interruptions after that date.

Microsoft recommends the Logs Ingestion API or the Codeless Connector Framework, citing uninterrupted data ingestion, improved reliability, scalability and long-term support. Where the source exposes a suitable API, the Codeless Connector Framework is usually the lower effort route because there is no code to maintain.

It is an inventory exercise rather than a lookup, because the users are custom integrations rather than product connectors. Anything built by a previous supplier, any script pushing data from a line of business system, and anything written against the older ingestion pattern are the candidates.

Potential ingestion interruptions, which in practice means data silently stopping. A connector that stops sending does not raise an alert, and a workspace missing one source looks the same as a complete one until somebody queries that table and finds nothing recent.

After 31 March 2027, Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal, with Azure portal customers redirected. It affects runbooks, saved links, training material and any automation that assumes the Azure portal.

Four main routes. The Codeless Connector Framework for source APIs. The Log Ingestion API for Azure Monitor as part of an Azure Function or a Logic App. And using Azure Monitor Agent directly or Logstash. The right choice depends on whether you are polling, receiving or reading files.

Syslog messages appear in the Log Analytics Syslog table and CEF messages in the CommonSecurityLog table. Knowing that before writing queries saves time, and it is also the fastest way to confirm whether a newly configured source is actually arriving.

Not necessarily. For Syslog and CEF, the Azure Monitor Agent is installed either directly on the device or on a dedicated Linux-based log forwarder, depending on the device type. The forwarder pattern is what makes network appliances and embedded devices workable.

A solution, where one exists. Deploying a solution from the Content Hub brings the data connector together with related workbooks, analytics rules and playbooks in the same deployment. Installing the connector alone means recreating detection content that already existed.

It is a service to service connector integrating data from Office 365, Microsoft Entra ID, Microsoft Defender for Identity and Microsoft Defender for Cloud Apps. That is a substantial amount of coverage from a single connection, which makes it one of the highest value connectors to have configured.

It depends on the tier. Microsoft-supported connectors follow Azure support plans. Partner-supported connectors are supported by the partner named on the connector page. Community-supported connectors have no listed contact, and issues are raised in the Microsoft Sentinel GitHub community.

Only if you built the alerting for it, which most organisations have not. Checking when each table last received data takes a minute as a one-off, and turning that into per source alerting is the change that makes every downstream detection trustworthy.

Not selectively. Microsoft states specific records cannot be purged from the Sentinel data lake, and the data lake retains ingested data for the defined retention period even if the data is deleted at the source or in the analytics tier. The purge feature applies to the analytics tier only.

No. Changes to Purview settings do not have any effect on data stored in the Sentinel data lake. Data lake storage locations are also selected by the tenant administrator and may differ from the primary storage location of the source services, which matters for data residency questions.

We scope by the number of sources and how much custom integration exists. The free first step: for each table you rely on, check when it last received data. Any table that has been quiet for longer than it should have been is your most urgent finding.

That is one of the reasons to reach for the Logs Ingestion API in an Azure Function or Logic App rather than the Codeless Connector Framework. Where the source needs custom logic, transformation or an authentication pattern the framework cannot express, the function route is the supported answer.

For the sources it covers, largely yes. It is a service to service connector integrating data from Office 365, Microsoft Entra ID, Microsoft Defender for Identity and Microsoft Defender for Cloud Apps, so one connection covers what would otherwise be four separate integrations to maintain.

Know that you depend on it, and plan accordingly. Community-supported connectors have no listed support contact, and issues are raised in the Microsoft Sentinel GitHub community. That is workable for a secondary source and uncomfortable for one feeding a detection you rely on.

Ingestion review

Fifteen questions about your own Sentinel data.

The first group has a deadline attached. The third is the one that determines whether you find out about a broken connector before an incident does.

Deadlines

Does anything use the HTTP Data Collector API?
Support ends 14 September 2026.
Did a previous supplier build integrations?
Those are the likeliest candidates.
Are we still using the Azure portal?
Retired for Sentinel 31 March 2027.
Do our runbooks link to the Azure portal?
They will need updating.
Have we planned the Defender portal move?
There is a documented path.

Coverage

Which sources are connected today?
From evidence, not memory.
Is the Defender XDR connector enabled?
It brings four sources at once.
Are connectors installed with their solutions?
Solutions include detection content.
What support tier is each connector?
Community means no support contact.
Which sources have no analytics rules?
Ingestion with no detection.

Health

Would we notice if a source stopped?
Usually not.
Do we alert on ingestion gaps?
The fix for the above.
When did each table last receive data?
A one minute query.
Do CEF sources land in CommonSecurityLog?
Syslog goes to the Syslog table.
Who owns connector health?
Name them.

The pages around this one.

Microsoft Sentinel

The product these connectors feed.

Sentinel in the Defender portal

The move that becomes mandatory in March 2027.

SOC optimization

Making sure the data you ingest is actually used.

Next step

For each table you rely on, check when it last received data.

It is a one minute query per table and it finds connectors that stopped without telling anybody. Then check whether anything you built is still using the HTTP Data Collector API, because support for it ends on 14 September 2026.

Book a connector migration review Call +971 56 613 2743

Related Services

Explore more solutions that work great with this service

Feature

Inventoried and monitored

Connected, not monitored

Accumulated over years

Every ingestion path known

Yes

Mostly

Legacy API usage identified

Yes

Unknown

Silent ingestion failure detected

Alerted

Unused sources retired

Yes

Connectors installed with solutions

Yes

Sometimes

Rarely

Support tier known per connector

Yes

Sources mapped to analytics rules

Yes

Ready for the September 2026 deadline

Yes

Unknown

Ready for the Defender portal move

Planned

Not started

Ingestion volume understood

Yes

Partly

	Route	Best suited to
Solution from the Content Hub	Anything with an existing connector, since it brings detection content too
Service to service connector	Microsoft services and Amazon Web Services, integrating in real time
Codeless Connector Framework	A source that exposes an API you can poll, with no code to maintain
Logs Ingestion API in an Azure Function	Custom logic, transformation, or authentication the framework cannot express
Logs Ingestion API in a Logic App	Low code integration where an Azure Function is more than you need
Syslog via Azure Monitor Agent	Network and Linux devices, landing in the Syslog table
CEF via Azure Monitor Agent	Security appliances emitting CEF, landing in CommonSecurityLog
Custom logs via the agent	Applications that only write log files, landing in custom tables
Azure Monitor Agent directly or Logstash	Custom connector scenarios outside the above
Legacy HTTP Data Collector API	Nothing, after 14 September 2026

Route

Best suited to

Solution from the Content Hub

Anything with an existing connector, since it brings detection content too

Service to service connector

Microsoft services and Amazon Web Services, integrating in real time

Codeless Connector Framework

A source that exposes an API you can poll, with no code to maintain

Logs Ingestion API in an Azure Function

Custom logic, transformation, or authentication the framework cannot express

Logs Ingestion API in a Logic App

Low code integration where an Azure Function is more than you need

Syslog via Azure Monitor Agent

Network and Linux devices, landing in the Syslog table

CEF via Azure Monitor Agent

Security appliances emitting CEF, landing in CommonSecurityLog

Custom logs via the agent

Applications that only write log files, landing in custom tables

Azure Monitor Agent directly or Logstash

Custom connector scenarios outside the above

Legacy HTTP Data Collector API

Nothing, after 14 September 2026

The legacy HTTP Data Collector API stops being supported after 14 September 2026.

Eight things to establish about your own ingestion.

What is still using the legacy API

Where that data should go instead

Service to service connectors for Microsoft and AWS

Syslog and CEF through the Azure Monitor Agent

Custom logs and custom tables

Who supports each connector you rely on

Connectors arrive as part of solutions

The portal move, with its own date

After 14 September 2026, anything on the legacy HTTP Data Collector API may simply stop arriving.

Four things that make ingestion reliable rather than assumed.

We find the legacy API usage before the deadline finds it

We ask what actually uses each source

We add alerting for silence

We install solutions rather than bare connectors

Four phases across roughly four to six weeks.

Inventory every ingestion path

Decide migrate or retire, per source

Migrate, preferring codeless where it fits

Add ingestion monitoring and plan the portal move

Six situations where ingestion is the problem.

An organisation with integrations built by a previous supplier

A business that discovered a gap during an investigation

A regulated firm evidencing log coverage

An operator with network and appliance logs

A company with line of business applications that only write files

An organisation planning data lake retention

How UAE organisations manage Sentinel ingestion.

How to get a source into Sentinel, and when each fits.

Five steps, and the second one saves the most work.

Inventory every path data takes into the workspace

Map sources to what consumes them

Migrate the legacy paths to supported routes

Add ingestion health monitoring

Plan the Defender portal transition

What organisations ask about Sentinel data connectors.

What is the September 2026 deadline?

What should we migrate to?

How do we find what is using the legacy API?

What happens if we miss the date?

What is the March 2027 date about?

How many ways are there to build a custom connector?

Where do Syslog and CEF events end up?

Do we install the agent on every device?

Should we install a connector or a solution?

What does the Defender XDR connector bring in?

Who supports a connector when it breaks?

How do we know if a source has stopped sending?

Can we delete data from the data lake?

Does Purview control the data lake?

What does an engagement cost?

Can we transform data before it lands?

Does the Defender XDR connector replace individual connectors?

What should we do about a community-supported connector we depend on?

Fifteen questions about your own Sentinel data.

Deadlines

Coverage

Health

The pages around this one.

Microsoft Sentinel

Sentinel in the Defender portal

SOC optimization

For each table you rely on, check when it last received data.

Related Services

Sentinel Analytics Rules

Microsoft Sentinel

Sentinel to the Defender Portal

Sentinel SOC Optimization

KQL Threat Hunting

SOC-as-a-Service

Managed Security Services

Defender XDR

The legacy HTTP Data Collector API stops being supported after 14 September 2026.

Eight things to establish about your own ingestion.

What is still using the legacy API

Where that data should go instead

Service to service connectors for Microsoft and AWS

Syslog and CEF through the Azure Monitor Agent

Custom logs and custom tables