How to fix data connector for MDE (Sentinel)

Voiture 0

Can't connect Sentinel to my MDE portal as it says that I do not have the required license but I have got it and have workstation onboarded

Voiture 0 Reputation points

2023-10-26T07:01:32.05+00:00

I have the MDE P2 license activated on all my users
Marilee Turscak-MSFT 36,846 Reputation points Microsoft Employee

2023-10-27T19:38:33.49+00:00

@Voiture Just checking to see if you were able to get the information you were looking for and if you have further questions? If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions. Otherwise, let us know if you have further questions.
JamesTran-MSFT 36,626 Reputation points Microsoft Employee

2023-11-08T23:40:16.91+00:00

@Voiture

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Clive Watson 6,436 Reputation points MVP

2023-10-26T08:45:22.5466667+00:00
Can I please check that you are using the Microsoft 365 Defender connector from content Hub?

There are other prerequisites, you also need:

source: https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE

You must have a valid license for Microsoft 365 Defender, as described in Microsoft 365 Defender prerequisites.

Your user must be assigned the Global Administrator or Security Administrator roles on the tenant you want to stream the logs from.

Your user must have read and write permissions on your Microsoft Sentinel workspace.

To make any changes to the connector settings, your user must be a member of the same Microsoft Entra tenant with which your Microsoft Sentinel workspace is associated.

Install the solution for Microsoft 365 Defender from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.
Please sign in to rate this answer.
Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,461 Reputation points

2023-11-10T00:04:15.1133333+00:00

Hello @Voiture , let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Your answer