Share via

How to connect Azure Activity data connector in Sentinel

Ty 0 Reputation points
2025-01-10T20:39:41.94+00:00

Hello,

I am having trouble connecting the Data Connectors in Sentinel. The instructions in Microsoft Learn differ from what I observe in Sentinel, but here is what I have done thus far: I have installed the Azure Activity Data Connector from the Content Hub. Next, I opened the connector page and click ed "Launch Azure Policy Assignment wizard>". For the scope, I have selected mySubscription. In the Parameters tab, I selected myLogAnalyticsWorkspace, which is the Log Analytics workspace that I have deployed Sentinel to. In the remediation tab, I check the "Create a remediation task" check box, then I created the policy. I have confirmed in the Policy service that this policy was deployed, but in Sentinel the Azure Activity Data Connector still shows as disconnected, and no data is moving through the connector. What am I missing here?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,205 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 34,891 Reputation points Microsoft Employee
    2025-01-13T09:49:33.23+00:00

    @Ty Thank you for reaching out to us, came across this video - https://www.youtube.com/watch?v=gWK6n6Frg1o where detailed steps mentioned on how to connect Azure Activity data connector in Sentinel.

    I have followed the same steps in my subscription, after 15 to 30 mins, data started ingesting in Sentinel.

    If this doesn't help, let me know we can connect offline to review further on this.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.