Trying to add Microsoft Sentinel to a Log Analytics Workspace in Azure but keep getting error "The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period"

Question

I am trying to add Microsoft Sentinel to a Log Analytics Workspace connected to a Virtual Machine in the Azure portal but keep getting the error "The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period". I am using the free version of Azure with the $200 credits. I am in the process of learning cybersecurity fundamentals and this is part of a SIEM and Sentinel tutorial.

I have tried everything listed on https://learn.microsoft.com/en-us/answers/questions/1532600/error-gateway-did-not-receive-a-response-from-micr
But none of the solutions listed there have worked for me. I tried the Powershell solution but I encountered even more errors.

Here's a concise summary of the PowerShell issue I was experiencing:

I encountered persistent authentication issues in PowerShell while configuring Azure Sentinel and Log Analytics workspaces. Despite multiple attempts with different authentication methods, including disabling multi-factor authentication, I continued to receive timeouts and authentication failures when executing commands like connecting to Azure or adding Microsoft Sentinel to the workspace.

Answer 1

Hi @Aaqib Ali ,

There was an outage on 6/26 that was triggering this error, but it should be resolved now. I reached out to a colleague on the Sentinel team to see if there are any further updates on the outage, and will update this thread if there is any additional news. You should be able to add Miccrosoft Sentinel to the workspace successfully now.

If you are still facing the issue though, I would recommend performing the following troubleshooting steps to resolve the "The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period" error:

First, ensure that you have the correct prerequisite permissions:.

• To enable Microsoft Sentinel, you need contributor permissions to the subscription in which the Microsoft Sentinel workspace resides.
• To use Microsoft Sentinel, you need either Microsoft Sentinel Contributor or Microsoft Sentinel Reader permissions on the resource group that the workspace belongs to.

Then using Powershell, ensure that you have connected to the right subscription and have installed the Az module. You can re-establish access to the Microsoft Sentinel portal by running the commands below and removing the previous onboarding state:

install-module Az
import-module Az

install-module Az.SecurityInsights
import-module Az.SecurityInsights

Connect-AzAccount
Set-AzContext -Subscription <subscription-id for sub with LogAnalytics workspace>

Remove-AzSentinelOnboardingState -ResourceGroupName "<rg-name" -workspaceName "<LogAnalytics workspacename>" -Name "default"
 
New-AzSentinelOnboardingState -ResourceGroupName "<rg-name" -workspaceName "<LogAnalytics workspacename>" -Name "default"

If you still run into any issues, do let me know and I will help troubleshoot and engage the right teams.

If the information helped you, please Accept the answer. This will help us and improve searchability for others in the community who may be researching the same error.

Answer 2

Thanks a lot for your response! It was indeed the outage that was the issue. It is working now without having to change anything.