Problem with Microsoft Sentinel Connector

Question

Hello, for test i have deploy sentinel 2 or 3 time and after that i delete Workpace.

Now i have recreted new Workspace and when i try connect connector i recevive the following error:

I have just try to find if there are other diagnostics settings but there isn't and there aren't workspace in pending delete.

How i can solve this problem ?

Regards,

Guido

Answer 1

Hi Guido, here are some suggestions:

• you said you checked diagnostics but you didn't say for which resource - the workspace? Azure activity?
• did you check Azure Policy - for example when you set up the Azure Activity data connector in Sentinel you create an Azure policy.
• did you look inside the resource group where sentinel and your workspace were created? any objects/resources in there that could be causing the issue?
• did you run the copilot diagnostics? any answers from that? (I know this one is a hit and miss..)

Good luck

Answer 2

Hi @Guido Imperatore

Thank you for posting this in Microsoft Q&A.

I understand you are trying to create new workspace but getting error "The limit of 5 diagnostic settings was reached. To create new setting 'SentinelExportSettings-sentinella', delete an existing one".

Each resource can have up to five diagnostic settings. so, if you have deployed and deleted workspace five times (without deleting the diagnostic settings), you will encounter this error the next time you deploy.

To resolve the issue, need to delete unused diagnostic you can be deleted from the Microsoft Entra admin center or using PowerShell commands.

Identify and Delete Unused Diagnostic Settings:

Get-AzSubscriptionDiagnosticSetting -Name test-setting

Remove-AzDiagnosticSetting -Name {setting-name} -ResourceId "/subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/{resource-provider}/{resource-name}"

But i delete all resources from subscription without delete Diagnostics settings, so i think this generate this problem ?

To delete a resource, rename, or move a resource, or migrate it across resource groups or subscriptions, first delete its diagnostic settings. Otherwise, if you recreate this resource, the diagnostic settings for the deleted resource could be included with the new resource, depending on the resource configuration for each resource.

Make sure there are no soft-deleted resources that might still hold diagnostic settings. You can check this in the Azure portal under the "Soft Delete" section. If the workspace is in soft-delete state, you must recover the workspace first and permanently delete it then.

For your reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/delete-workspace?tabs=azure-portal#recover-a-workspace-in-a-soft-delete-state

If you are still encountering same issue, please send us an email on azcommunity@microsoft.com with Sub - "ATTN: Navya" and following details in the email body: Link to this thread/post. We can connect offline and discuss further on this.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.