How to fix data connector for MDE (Sentinel)

Voiture 0 Reputation points

Can't connect Sentinel to my MDE portal as it says that I do not have the required license but I have got it and have workstation onboarded

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
866 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
92 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Clive Watson 4,336 Reputation points MVP

    Can I please check that you are using the Microsoft 365 Defender connector from content Hub?

    User's image

    There are other prerequisites, you also need:


    You must have a valid license for Microsoft 365 Defender, as described in Microsoft 365 Defender prerequisites.

    Your user must be assigned the Global Administrator or Security Administrator roles on the tenant you want to stream the logs from.

    • Your user must have read and write permissions on your Microsoft Sentinel workspace.

    To make any changes to the connector settings, your user must be a member of the same Microsoft Entra tenant with which your Microsoft Sentinel workspace is associated.

    Install the solution for Microsoft 365 Defender from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.