Integrating Microsoft Sentinel with Microsoft Defender XDR

Question

I am trying to Integrate microsoft sentinel and defender XDR.

So here are the steps I have done so far.

1. Log analytics created,
2. Sentinel attached to the workspace
3. enabled the defender connector .
4. after enabling the connector , I have enabled connection for incidents and alerts.
5. also connected few events

All these activities were done by a user who has GA and Security adminstrator rights.

Now, when i log into security.microsoft.com and connect the workspace to Microsoft defender. I get this error .

A screenshot has also been attached . its the image called S1 .

I then navigated to settings in Microsoft defender -> Sentinel -> Found the workspace then tried to connect. A different error message here.

Failed to assign roles to subscription: The content of your request was not valid, and the original object could not be deserialized. Exception message: 'Required property 'principalId' expects a value but got null. Path 'properties', line 1, position 240.'

A screenshot with image name S2 is attached.

Any ideas will be really helpful.

Thank you

Answer 1

Hi @Anand Rao Nednur ,

I understand that you are receiving the error, "Couldn't connect the workspace" and "Failed to assign roles to subscription."

In order to assign RBAC roles to a subscription, you need to be logged in with an account that has Microsoft.Authorization/roleAssignments/write permissions, such as Role Based Access Control Administrator or User Access Administrator. Note also that to enable Sentinel, the account needs to have Contributor permissions on the subscription where the workspace resides.

If the permissions are set correctly and you are still seeing issues with the workspace connector, I would recommend disconnecting and reconnecting the Defender XDR connector and trying again.

I've also looped in a colleague from the Sentinel team to look into your request since I was unable to find documentation for those specific errors. I'll update this thread as I have more information.

If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions.

Answer 2

Thanks for your quick response.

The permissions granted to the logged in user are at the root level. Being a Owner and also Microsoft Sentinel contributor , i assumed this should be sufficient. I also added in the security administrator role and tried.

I have however noticed that an app called Microsoft Threat protection automatically gets aded to the Role assignment section at the subscription level and Microsoft Sentinel Contributor role gets assigned to it . This seems to be the behaviour of the integration setup . ( i have removed the role (to test this ) and reran the integration procedure, the role gets added again ) .

I then navigate to Activity logs at the subscription level and noticed a ton of errors .

Here is the Message from the error :

The content of your request was not valid, and the original object could not be deserialized. Exception message: 'Required property 'principalId' expects a value but got null. Path 'properties', line 1, position 240.'

I then created another log analytics , onboarded Sentinel . loaded the XDR connector . and tried connecting to the workspace via security.microsoft.com . I could replicate the issue.

Thank you for any possible hints / direction.

Anand