Azure Activity Data connector not getting delelet from MS Sentinel

Muhammad Rizwan 5

I'm not able to delete Azure Activity data connector from MS Sentinel. I had deleted the Azure policy the one created by connector and also removed IAM role on subscription for the managed identities created by connector while adding it. After all connector is still connected and getting data from Azure Monitor, if I delete the data connector (after clicking on 3 dots) but nothing happens.

2 answers

Muhammad Rizwan 5 Reputation points

2025-02-26T05:23:44.49+00:00

Hi Alex,

So I contact MS support and they gave me solution, they told me to stop sending logs to log analytic workspace from Activity log in Azure Monitor (shown in screenshot).

But still connector is connected in Sentinel. They told that it takes 14 days to get connector in disconnect states after we stop sending the logs to workspace. Let,s see, now I'm waiting for 14 days.
Please sign in to rate this answer.

1 person found this answer helpful.
Alex Burlachenko 1,665 Reputation points

2025-02-26T05:25:56.4266667+00:00

Nice to hear that... u are very welcome
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Alex Burlachenko 1,665 Reputation points

2025-02-19T12:12:46.9533333+00:00

Hey mate,

If you’re stuck trying to delete the Azure Activity data connector in MS Sentinel, try that...

Make sure you’ve got the right permissions (Sentinel Contributor). Check if there are any dependent rules or settings in Sentinel. Try deleting it via API or PowerShell if the UI isn’t working. In Azure Monitor, check if data is still being sent to the Log Analytics workspace. If all else fails, raise a ticket with Microsoft Support.

Let me know how it goes! Cheers! 😊

Alex
Please sign in to rate this answer.
Muhammad Rizwan 5 Reputation points

2025-02-19T13:36:00.19+00:00

Hi Alex,

Thanks for you prompt response. I already have owner role at subscription. I can't see the dependent rules for this connector. With PowerShell it asks for Id of connector, I'm unable to find out the Id of connector in Azure. There is not rule for this connector in Monitor as well.

Venkata Jagadeep 180 Reputation points Microsoft Vendor

2025-02-20T21:51:35.6466667+00:00

Hello Muhammad Rizwan,

We understand that you are not able to delete Azure Activity data connector from Microsoft Sentinel even after removing the policies.

And you mentioned having owner role at subscription.

Need to check at subscription if the Azure Activity Data Connector is locked to delete.

If the Log Analytics workspace or any of the associated resources are locked, it can prevent the deletion of connectors.

Please navigate to Azure Portal - Select the resource - Locks

Here you can see any active locks. Need to make sure remove any locks related.

The Azure Activity Data Connector may be actively collecting data. Some connectors cannot be deleted if they are being actively collecting data.

Venkata Jagadeep 180 Reputation points Microsoft Vendor

2025-02-24T23:07:12.4+00:00

Hello Muhammad Rizwan,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Venkata Jagadeep 180 Reputation points Microsoft Vendor

2025-02-26T00:22:56.4666667+00:00

Hello Muhammad Rizwan,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Muhammad Rizwan 5 Reputation points

2025-02-26T05:20:53.6933333+00:00

Hi Alex,

So I contact MS support and they gave me solution, they told me to stop sending logs to log analytic workspace from Activity log in Azure Monitor (shown in screenshot).

But still connector is connected in Sentinel. They told that it takes 14 days to get connector in disconnect states after we stop sending the logs to workspace. Let,s see, now I'm waiting for 14 days.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Activity Data connector not getting delelet from MS Sentinel

2 answers

Your answer