Cannot enable UEBA feature on Sentinel

Question

Hi,

I'm having some issues while trying to enable the UEBA feature in a Sentinel instance. When I try to turn the switch ON, I get the following error message: "Updating the Entity Providers failed". I've seen 2 questions related to this issue but unfortunately there were no successful solutions. Here's a screenshot:

I have the following setup:

• Guest account implemented through B2B architecture.
• Global Admin role
• User access admin role in the subscription
• Owner role in the resource group where Sentinel is hosted

Do you know any solution for this or the cause?

Thanks in advance for your help.

Answer 1

@Alberto Barrado Jiménez Thank you for reaching out to us, As I understand you are trying to enable UEBA feature on Sentinel. As per this documentation to enable or disable this feature below are the requirements

1. user must be assigned to the Microsoft Entra ID Security Administrator role in your tenant or the equivalent permissions, Global admin privilege might not help, add the security administrator role and verify the outcome.
2. user must be assigned at least one of the following Azure roles - Microsoft Sentinel Contributor at the workspace or resource group levels or Log Analytics Contributor at the resource group or subscription levels.

Would recommend checking the above mentioned prereqs and let me know if this helps or not.