Whenever I try to create microsoft sentinel it shows error

Question

Failed to add Microsoft Sentinel

Failed to add Microsoft Sentinel to workspace 'SentinelRG'. The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period.

Answer 1

@Zawar Khan Thank you for reaching out to us, As I understand you are unable to deploy/add Microsoft Sentinel, while doing the same you are getting this error Failed to add Microsoft Sentinel to workspace 'SentinelRG'. The gateway did not receive a response from 'Microsoft.SecurityInsights' within the specified time period.

Is this a new setup ? was this working before for example you are trying to create sentinel on existing workspace ?

To begin with verify this option - Azure portal-> Subscriptions->Resource Provider -> please check whether MicrosoftSecurityInsights is registered or not. If it is not registered, kindly register it.

Next to check the permissions on the log analytics workspace - https://learn.microsoft.com/en-us/azure/sentinel/roles#:~:text=Azure%20and%20Log%20Analytics%20roles%20you%20might%20see%20assigned

Reviewed few cases internally where below change has been recommended -

https://learn.microsoft.com/en-us/azure/sentinel/enroll-simplified-pricing-tier?tabs=azure-resource-manager#change-pricing-tier-to-simplified

Would recommend try these steps and let me know the outcome.

Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.