Microsoft Defender XDR data connector screen shows errors

Question

Microsoft Defender XDR data connector screen shows errors

Pawel Dlugosz 0

Hi all,

Looking for any suggestions on how to troubleshoot this warning popping up on Defender XDR configuration page. The connector seems to be working fine but this pop up window comes up every time I open the page. Any help will be appreciated!

image (1)

Best,

Pawel

Shweta Mathur 30,301 Reputation points Microsoft Employee Moderator

2024-04-01T08:04:57.7166667+00:00

@Pawel Dlugosz

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Pawel Dlugosz 0 Reputation points

2024-04-01T08:12:28.7966667+00:00

Hi Shweta,

Thank you for looking in to this, unfortunately it did not. I have already provided my reply to the initial response in the thread below.

Best,

Pawel

1 answer

Your answer

Shweta Mathur 30,301 Reputation points Microsoft Employee Moderator

2024-04-01T08:04:57.7166667+00:00

@Pawel Dlugosz

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Pawel Dlugosz 0 Reputation points

2024-04-01T08:12:28.7966667+00:00

Hi Shweta,

Thank you for looking in to this, unfortunately it did not. I have already provided my reply to the initial response in the thread below.

Best,

Pawel

Answer 1

Akshay-MSFT 17,961 Microsoft Employee Moderator

@Pawel Dlugosz

From above description it seems like you are trying to access data connector blade in Microsoft Sentinel but getting an access restriction prompt.

Please do correct me if this is not the ask by responding in the comments section.

This seems to be an issue due to conditional access policy for a device state or the account you tried to login with does not have enough permission on the tenant directory.

To start with CA kindly navigate to Entra.Microsoft.com > Protection > Risk activities > Look for Risky sign-ins or risky detections > choose the events referring to the error above and look for basic info and conditional access triggers. PFB screenshot for reference.

Try using Microsoft edge as other browsers without extension or outdated versions may not carry the device info (session ID and device ID) while proving the device identity via PRT.

User's image

For 2nd scenario related to the user permission or directory information, kindly validate if you are logged into correct directory and if the account used is the desired one. Once confirmed switch to correct directory by choosing it.

User's image

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik

Pawel Dlugosz 0 Reputation points

2024-03-27T16:05:00.64+00:00

Hello sir, thanks for replying so promptly, this is very appreciated.

So, I've asked my client to check on both scenarios and reviewing risk activities did not yield any results, see below:

This screen was accessed shortly after we generated the error and so if there's something relating to it here we would have expected to see it, but nothing was shown as you can see.

The second scenario was to confirm which subscription we've been truing this in but once the client navigated to the aforementioned screen they could only see one subscription shown on the list despite the fact there're more in the filter drop-down:

In the filter one could see all the subs this account had visibility on, the one which is redacted on the pic wasn't the one we had Microsoft XDR error on, btw.

Not sure if that helps you understand the challenge a little bit better but if it doesn't let me know what else you want me to verify with my client. Thank you.
Akshay-MSFT 17,961 Reputation points Microsoft Employee Moderator

2024-04-09T10:52:33.3533333+00:00
@Pawel Dlugosz

Could you please validate if there is any CA policy defined to block access based on risk state?

Also if you could check signin logs for the impacted admin account ?

Thanks,

Akshay Kaushik
Pawel Dlugosz 0 Reputation points

2024-04-10T13:43:28.2566667+00:00

Hi @Akshay-MSFT

Unfortunately we didn't see any errors or warnings on risk activities screen and we seemed to be logged into the desired directory in the first place. Is there anything else you can think of we might need to check?

Thank you for your support so far, much appreciated!
Pawel Dlugosz 0 Reputation points

2024-04-10T13:49:02.4+00:00

Hi Akshay-MSFT, sorry I missed your q there, apologies. Let me verify if there are any CA policies within the org that are based on the risk state. I'll get back to you.

Share via

Microsoft Defender XDR data connector screen shows errors

1 answer

Your answer