Azure sentinel and Azure Active directory connector not working

Azurelearner 1 Reputation point
2021-04-29T02:41:16.813+00:00

I am facing issues with enabling Azure Active directory connector in Azure sentinel.

I have fulfilled all the per-requiste for enabling Azure Active directory connector.

Workspace: read and write permissions are required.

Diagnostic Settings: required read and write permissions to AAD diagnostic settings.

Tenant Permissions: required 'Global Administrator' or 'Security Administrator' on the workspace's tenant.

I have P2 license, Global Administrator permission and read and write permissions on Workspace. Yet none of the data types that is

Sign-in logs
Audit logs
Non-interactive user sign-in log (Preview)
Service principal sign-in logs (Preview)
Managed Identity Sign-in logs (Preview)
Provisioning logs (Preview)

are getting enabled or connecting. I am however able to enable other connectors. I have also Diagnostic settings in Azure Active directory and sending logs to the same workspace. I have tried it multiple times and different regions but with same result.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
990 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Yash Mudaliar 191 Reputation points Microsoft Employee
    2021-04-29T13:29:11.583+00:00

    It surely does not seem like issue with the data connector but with Azure AD's connectivity. Still, can you share the screen shot of the connector page?

    0 comments