Microsoft Sentinel can automatically disable scheduled analytics rules and mark them "AUTO DISABLED" when their executions repeatedly fail. A common cause is query performance issues, such as long-running queries that exceed execution time limits or hit throttling, especially with large lookback windows or inefficient joins. When a rule's query persistently times out, Sentinel halts it to protect service health and prevent unnecessary load. Other options listed don't align as primary triggers in Sentinel's auto-disable behavior: exceeding 10,000 alerts in two minutes is not the documented threshold used to auto-disable rules; generic "connectivity issues" are not specific to a single rule; permissions changes can cause failures but the well-known, tested cause that leads to the AUTO DISABLED prefix in practice is repeated timeout/failure of the query itself.