This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 20%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAS%3C/text%3E%3C/svg%3E)
Folks,
We h aveAzure AD P1 plan. We're doing the 30 day trial to evaluate Microsoft Sentinel, when I try to enable the data connector, for example selecting "Sign-in Logs" I get the error "Failed to apply the changes" when I click "Apply Changes" . The error is always the same, it doesn't matter what option (Ex Audit Logs) I select.
Please advise,
Andy
Thank you for your post!
Since I wasn't able to reproduce your issue on my end, can you make sure that you met the pre-requisites?
If the user that you're currently signed in with meets the pre-reqs; can you see if selecting Audit logs, or any other log selection besides Sign-in Logs produces a similar issue?
Thank you for your time and patience throughout this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(284.8, 88%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENC%3C/text%3E%3C/svg%3E)
fyi, This resolved the issue for me:
Navigate to Azure Active Directory > Diagnostic Settings (left hand side) > enable from there.
Also having this issue on 3x tenants.
HI James,
Thanks for your reply, My user met all prerequisites. I haven't had any problems enabling other MS connectors in Sentinel. I tried to enable one by one the other options with this specific connector in the configuration: same error not matther what.
Something weird is going on... how can I get more details about this error?
rgds
Andy
I noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
If you have any other questions, please let me know. Thank you!
fyi, This resolved the issue for me:
Navigate to Azure Active Directory > Diagnostic Settings (left hand side) > enable from there.
Thanks Nick, in my case I had another Analytics workspace enabled in Azure AD, I guess that's why it was showing the error. Sentinel needs to be better recognizing this. I changed to the correct workspace and it started to work. You're the best!
Thank you for following up on this and I'm glad that you were able to resolve your issue!
I've passed along your information to our Sentinel team, and I also noticed a few Support Requests open regarding this issue.
If you'd like our support team to take a closer look into your environment and logs in order to determine a root cause, please let me know and I'd be happy to work with you to enable a free technical support request for your subscription.
Thank you for your time and patience throughout this issue.
James, if working with the support team to take a look of the logs helps to improve the product, I'm happy to assist
Best,
Andy
Thank you for following up on this!
Can you please email me with the info below. I'll go ahead and enable a one-time free technical support request for your subscription so our support team to take a closer look into your environment and logs in order to determine a root cause.
Email: AzCommunity@microsoft.com
Subject: ATTN - James Tran
Body:
Azure Subscription ID
Link to this issue
I also noticed that your recent experience was not helpful, and to better improve our processes and learn from our customers, I'm eager to know what could have been done better.
If you have any other questions, please let me know. Thank you!