Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,065 questions
Microsoft Defender for Office 365 (0/5 connected) : In Defender XDR connector, Office 365 logs cannot be connected in Sentinel.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(64, 35%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESC%3C/text%3E%3C/svg%3E)
Sayeem Chowdhury
20
Reputation points
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 16%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERG%3C/text%3E%3C/svg%3E)
Rakesh Gurram 5,485 Reputation points Microsoft Vendor2024-03-19T15:39:44.7566667+00:00 Thank you for reaching out to us on Microsoft Q&A forum.
Thanks for raising this query, could you please specify the exact Learn Path (exercise/URL) where you are encountering this error.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(28.799999999999997, 3%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
anand 230 Reputation points2024-03-19T16:39:55.7433333+00:00 Thank you for your post!
When it comes to sending your Office 365 Information Governance alerts to Microsoft Sentinel, we currently have the below Data Connectors within Sentinel that should help point you in the right direction.
Microsoft Sentinel data connectors:
- Microsoft Office 365 - This connector will get details of operations such as file downloads, access requests sent, changes to group events, set-mailbox and details of the user who performed the actions.
- Microsoft Defender for Office 365 - This connector with incident integration allows you to stream all M365D incidents and alerts into Microsoft Sentinel, and keeps the incidents synchronized between both portals
Additional Links: Microsoft 365 Defender Microsoft Defender for Office 365 How to Protect Office 365 with Azure Sentinel
If you have any other questions or if this isn't what you're looking for, please let me know. Thank you for your time and patience throughout this issue.
Please remember to "Upvote" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.
-
Sayeem Chowdhury 20 Reputation points
2024-03-19T17:00:16.5366667+00:00 During the SecOpsAnalyst Career learning path, I had a module sc200-Connect logs to sentinel where i had to connect microsoft defender xdr solutions from content hub. In the solutions, I had to select the checkbox for defender for office log data to stream in sentinel but I couldn't. And the screenshot was attached above their with the question.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
Givary-MSFT 30,931 Reputation points Microsoft Employee2024-03-20T09:10:54.34+00:00 @Mohammad Sayeem Chowdhury Have you tried installing the Defender XDR solution from content hub - https://learn.microsoft.com/en-us/azure/sentinel/microsoft-365-defender-sentinel-integration further solution is installed, you can navigate to connector and enable the logs from the above-mentioned tables.
Sign in to comment