# Microsoft Sentinel Rule Not Saving? - Here's Why (ETag Errors).

# Introduction.

While making a small update to an analytics rule in Microsoft Sentinel, I hit an unexpected roadblock. I tried saving the rule, and Sentinel threw this error:

> **Failed to save analytics rule '\[REDACTED\]'. Conflict: Newer instance of rule '\[REDACTED\]' exists for workspace '\[REDACTED\]' (ETag does not match). Data was not saved.**

This happens when the rule has been modified elsewhere (e.g., by another user), and Sentinel uses an **ETag** to detect those changes. It's designed to stop you from accidentally overwriting a newer version, but in this case, it just blocked me from saving a minor update.

---

# What I Did Instead.

Rather than digging into ARM templates or scripting around it, I took a simple approach:

1. **Duplicated the rule manually.**
    
2. **Adjusted the rule name slightly (just capitalised the words).**
    
3. **Applied my change.**
    
4. **Disabled the original rule.**
    
5. **Tested the new one.**
    
6. **Deleted the old rule once everything checked out.**
    

---

# Quick, Clean, Done.

This is probably not the “correct” or a recommended solution. But for a low-risk edit in a controlled environment, this workaround saved me a lot of time and avoided unnecessary overhead.

If Sentinel ever throws an ETag conflict your way, and the change is minor, starting fresh might be faster than fighting it.