25,124 questions
fyi, This resolved the issue for me:
Navigate to Azure Active Directory > Diagnostic Settings (left hand side) > enable from there.
Cannot enable Azure Active Directory conector in Sentinel
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 20%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Andrés Martínez
25
Reputation points
Folks,
We h aveAzure AD P1 plan. We're doing the 30 day trial to evaluate Microsoft Sentinel, when I try to enable the data connector, for example selecting "Sign-in Logs" I get the error "Failed to apply the changes" when I click "Apply Changes" . The error is always the same, it doesn't matter what option (Ex Audit Logs) I select.
Please advise,
Andy
Microsoft Security | Microsoft Entra | Microsoft Entra ID
Microsoft Security | Microsoft Sentinel
1,298 questions
{count} vote
-
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator2023-01-20T00:45:27.8+00:00 Thank you for your post!
Since I wasn't able to reproduce your issue on my end, can you make sure that you met the pre-requisites?
- Workspace: read and write permissions.
- Diagnostic Settings: read and write permissions to AAD diagnostic settings.
- Tenant Permissions: 'Global Administrator' or 'Security Administrator' on the workspace's tenant.
If the user that you're currently signed in with meets the pre-reqs; can you see if selecting
Audit logs, or any other log selection besidesSign-in Logsproduces a similar issue?Thank you for your time and patience throughout this issue.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 88%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENC%3C/text%3E%3C/svg%3E)
Nick C 86 Reputation points2023-01-20T14:20:57.7233333+00:00 fyi, This resolved the issue for me:
Navigate to Azure Active Directory > Diagnostic Settings (left hand side) > enable from there.
-
Nick C 86 Reputation points
2023-01-20T17:04:28.34+00:00 Also having this issue on 3x tenants.
-
Andrés Martínez 25 Reputation points
2023-01-20T17:04:59.26+00:00 HI James,
Thanks for your reply, My user met all prerequisites. I haven't had any problems enabling other MS connectors in Sentinel. I tried to enable one by one the other options with this specific connector in the configuration: same error not matther what.
Something weird is going on... how can I get more details about this error?
rgds
Andy
-
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator
2023-01-20T20:11:38.0366667+00:00 I noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
If you have any other questions, please let me know. Thank you!
Sign in to comment
Accepted answer
-
Nick C 86 Reputation points
2023-01-20T14:21:13.6566667+00:00 -
Andrés Martínez 25 Reputation points
2023-01-20T19:29:10.98+00:00 Thanks Nick, in my case I had another Analytics workspace enabled in Azure AD, I guess that's why it was showing the error. Sentinel needs to be better recognizing this. I changed to the correct workspace and it started to work. You're the best!
-
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator
2023-01-20T19:53:49.7966667+00:00 Thank you for following up on this and I'm glad that you were able to resolve your issue!
I've passed along your information to our Sentinel team, and I also noticed a few Support Requests open regarding this issue.
If you'd like our support team to take a closer look into your environment and logs in order to determine a root cause, please let me know and I'd be happy to work with you to enable a free technical support request for your subscription.
Thank you for your time and patience throughout this issue.
-
Andrés Martínez 25 Reputation points
2023-01-21T00:57:54.8733333+00:00 James, if working with the support team to take a look of the logs helps to improve the product, I'm happy to assist
Best,
Andy
-
JamesTran-MSFT 36,911 Reputation points Microsoft Employee Moderator
2023-01-26T21:12:47.1+00:00 Thank you for following up on this!
Can you please email me with the info below. I'll go ahead and enable a one-time free technical support request for your subscription so our support team to take a closer look into your environment and logs in order to determine a root cause.
Email: AzCommunity@microsoft.com Subject: ATTN - James Tran Body: Azure Subscription ID Link to this issueI also noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
If you have any other questions, please let me know. Thank you!
Sign in to comment -