Azure Activity Data connector not getting delelet from MS Sentinel

Muhammad Rizwan 0

I'm not able to delete Azure Activity data connector from MS Sentinel. I had deleted the Azure policy the one created by connector and also removed IAM role on subscription for the managed identities created by connector while adding it. After all connector is still connected and getting data from Azure Monitor, if I delete the data connector (after clicking on 3 dots) but nothing happens.

1 answer

Alex Burlachenko 1,190 Reputation points

2025-02-19T12:12:46.9533333+00:00

Hey mate,

If you’re stuck trying to delete the Azure Activity data connector in MS Sentinel, try that...

Make sure you’ve got the right permissions (Sentinel Contributor). Check if there are any dependent rules or settings in Sentinel. Try deleting it via API or PowerShell if the UI isn’t working. In Azure Monitor, check if data is still being sent to the Log Analytics workspace. If all else fails, raise a ticket with Microsoft Support.

Let me know how it goes! Cheers! 😊

Alex
Please sign in to rate this answer.
Muhammad Rizwan 0 Reputation points

2025-02-19T13:36:00.19+00:00

Hi Alex,

Thanks for you prompt response. I already have owner role at subscription. I can't see the dependent rules for this connector. With PowerShell it asks for Id of connector, I'm unable to find out the Id of connector in Azure. There is not rule for this connector in Monitor as well.

Venkata Jagadeep 170 Reputation points Microsoft Vendor

2025-02-20T21:51:35.6466667+00:00

Hello Muhammad Rizwan,

We understand that you are not able to delete Azure Activity data connector from Microsoft Sentinel even after removing the policies.

And you mentioned having owner role at subscription.

Need to check at subscription if the Azure Activity Data Connector is locked to delete.

If the Log Analytics workspace or any of the associated resources are locked, it can prevent the deletion of connectors.

Please navigate to Azure Portal - Select the resource - Locks

Here you can see any active locks. Need to make sure remove any locks related.

The Azure Activity Data Connector may be actively collecting data. Some connectors cannot be deleted if they are being actively collecting data.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Activity Data connector not getting delelet from MS Sentinel

1 answer

Your answer