This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(169.60000000000002, 14.000000000000002%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
We are currently doing integration testing between Sentinel and XDR.
After onboarding and offboarding the workspace from XDR side several times ,following the steps provided in Microsoft's official documentation, encountered the following symptoms.
To collect incidents ＆ alerts on XDR, we had Installed Microsoft Defender XDR Connector.now appearing the message "One or more of your workspaces are onboarded to USX.Incidents and alerts configuration is disabled."
it seems no exist other workspace on the same tenant and already removed old workspace data from XDR.
Also, we had checked prequsites following this aricle ; https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?source=recommendations&tabs=MDE#prerequisites
And, checking and tried to this method following these articles,too ;
What shoud we do ?
What's the cause of this symptom? hope to integrate with Sentinel and XDR as USX again !
we have been spending many time to fixing about this for about 50 days.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Ryo Suzuki Thank you for reaching out to us, let me research on this issue and revert back.
In the meantime could you please share your contact details in order to have a session over the teams for better understanding of the issue.
Please send me an email to 'AzCommunity@microsoft.com' with Sub - Attn: Givary and following details in the email body:
Link to this thread/post
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(240, 62%, 33%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
@Givary-MSFT May I get the solution how it's resolved ?
@Ryo Suzuki Please capture browser trace at the time of issue (HAR trace)
Refer to this links on the steps how to capture
https://learn.microsoft.com/en-us/azure/azure-portal/capture-browser-trace
https://www.youtube.com/watch?v=thsPBE0lA5I
Also, help me with the tenant id to investigate this further.
Share these details over the email 'AzCommunity@microsoft.com' with Sub - Attn: Givary
@Ryo Suzuki We connected offline and reviewed the logs with assistance from the engineering team. With their help, we successfully resolved the issue.
If you have any further questions, please feel free to post them here!
@Givary-MSFT Thank you for your support this time!
@Ryo Suzuki Our engineering team conducted a detailed investigation and discovered that the XDR was connected to a workspace that had been deleted a few months ago. This was the reason for your inability to connect to Sentinel from XDR.
Over the weekend, our team resolved the issue, and you confirmed via Teams that after these changes, you were able to connect to Sentinel from XDR without any problems.
Thank you so much ,Givary!!!!
This sympton was resolved by Givary and spledid support engineering team!
Also, I was so impressed your passion for Microsoft customers....
You had spent for many time for us until today.
To be honest,we were really at a loss for 70days ....
During that time,you had never igonored us on this discussion board.
I would like to applogies you for such a rudeness behaiviour this time.
Many many thanks to you and will take an active role on your field, Givary!!!!
Cheeeeeer up from Japan!!!!!!
Your support has made me love Microsoft even more!
Hi Team,
I'm facing exact same issue after changing the workspace in defender. Kindly suggest the solution.
Hi, @Shubham Pandey.
I wish my comment will help you for solving a similar issue.
Have you deleted a resource group including Sentinel resource from Azure side ,before
disconnecting XDR Connector from MS Defender XDR Portal?
This case happen that trigger by disconnect from Azure side forcedly.
Givary and Sentinel support team helped me change the settings from the MS architecture side after all.they were so kind and provided splendid support last time!
Really appreciate them!
so I would strongly recommend you to read following Link ,Also
if you will face to this symptom again, please ask Sentinel support team! I had spent time for three months about this after all.
Earlier a workspace was connected to xdr in defender portal. Since we migrated to different region so we created one more workspaces till the time we are not changing the workspace in xdr portal we are not getting this error but by the time we change the workspace in defender portal we are getting this issue.
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
2 deleted commentsComments have been turned off. Learn more
