How to fix data connector for MDE (Sentinel)

Question

How to fix data connector for MDE (Sentinel)

Voiture 0

Can't connect Sentinel to my MDE portal as it says that I do not have the required license but I have got it and have workstation onboarded

Voiture 0 Reputation points

2023-10-26T07:01:32.05+00:00

I have the MDE P2 license activated on all my users
Marilee Turscak-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-10-27T19:38:33.49+00:00

@Voiture Just checking to see if you were able to get the information you were looking for and if you have further questions? If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions. Otherwise, let us know if you have further questions.
JamesTran-MSFT 37,211 Reputation points Microsoft Employee Moderator

2023-11-08T23:40:16.91+00:00

@Voiture

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

1 answer

Your answer

Voiture 0 Reputation points

2023-10-26T07:01:32.05+00:00

I have the MDE P2 license activated on all my users
Marilee Turscak-MSFT 37,256 Reputation points Microsoft Employee Moderator

2023-10-27T19:38:33.49+00:00

@Voiture Just checking to see if you were able to get the information you were looking for and if you have further questions? If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions. Otherwise, let us know if you have further questions.
JamesTran-MSFT 37,211 Reputation points Microsoft Employee Moderator

2023-11-08T23:40:16.91+00:00

@Voiture

I wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Answer 1

Can I please check that you are using the Microsoft 365 Defender connector from content Hub?

User's image

There are other prerequisites, you also need:

source: https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE

You must have a valid license for Microsoft 365 Defender, as described in Microsoft 365 Defender prerequisites.

Your user must be assigned the Global Administrator or Security Administrator roles on the tenant you want to stream the logs from.

Your user must have read and write permissions on your Microsoft Sentinel workspace.

To make any changes to the connector settings, your user must be a member of the same Microsoft Entra tenant with which your Microsoft Sentinel workspace is associated.

Install the solution for Microsoft 365 Defender from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.

Alfredo Revilla - Upwork Top Talent | IAM SWE SWA 27,526 Reputation points Moderator

2023-11-10T00:04:15.1133333+00:00

Hello @Voiture , let us know if you need additional assistance. If the answer was helpful, please accept it and rate it so that others facing a similar issue can easily find a solution.

Share via

How to fix data connector for MDE (Sentinel)

1 answer

Your answer