Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
666 questions
Defender for Endpoint Users Not in MCAS
Sam C
46
Reputation points
Hey!
We've onboarded 15 users into Defender for Endpoint. Now that we've got the Sentinel Connector turned on to get the raw logs, we can see these machines/users reporting in. However, only 10 of these users show in the MCAS Cloud Discovery Dashboard. Trying to iron out this process before we push it out to more in the organization, any idea where machines might be dropping off? Does MCAS have some sort of user filtering that I don't know about? Thanks!
{count} votes
-
James Hamil 12,976 Reputation points Microsoft Employee2020-12-29T00:27:23.483+00:00 Hi! Have they shown up since this post? There may have been a delay to show them. I'm not aware of any user filtering, but I'm going to keep researching. Would you mind posting any screenshots you have of pertinent information?
Thanks,
James
Sign in to comment
@James Hamil Hey!
The other machines / users have not shown up yet. There was also a possible source of weirdness in that some of these users were licensed before having the Defender agent installed, and some it was installed and then licensed. Does the order matter there?
Hi Sam, you should submit a support ticket for this. That way we can get a better look at what's going on. Please let me know if you resolve the issue!
Best,
James