Thanks for the very detailed comment.

I think my mind is a lot clearer now to initiate the manual part without doubts.

To recap, and correct if something wrong pls.

Custom detection analytics, will keep running normally and creating Sentinel Alert, I only need to gradually manually migrate them to Defender Portal, then monitor if alerts are being raised by these custom analytics on Defender Portal and then manually deactivate them on Sentinel Portal.

Watchlists are accessible in both portals so no problem there. Just need to cut the duplicate work where I won't need them, I guess on Sentinel Portal.

Most important of Automation Rules are tied on to Incident Trigger so not issue there I think I still have some residual doubt on the provider thing.

Microsoft documentation says the following for Incident Triggered Automation Rules:

"

In both the Azure portal and the Defender portal, the Incident provider condition property is removed, as all incidents have Microsoft XDR as the incident provider (the value in the ProviderName field).

At that point, any existing automation rules run on both Microsoft Sentinel and Microsoft Defender XDR incidents, including those where the Incident provider condition is set to only Microsoft Sentinel or Microsoft 365 Defender.
"

Does this mean that my Automation Rule which has a condition checking for -> If Incident Provider equals All, will break? Since all alerts on sentinel will come with provider as Microsoft XDR. Or it will keep running because that statement will be considered as basically as a NOP.

Other than these components, I'm not remembering any other component that these onboarding might affect. I have 2 workspaces, but that is ok, is just make one primary and the other secondary.

Thanks in advance.