Share via

Azure Sentinel office 365 Tenant Permissions

Thomas Black 1 Reputation point
2021-01-03T15:10:17.247+00:00

Hello
Thanks for reading my post
Hopefully, this is simple to sort out but I seem to be going around in circles
setting up a test office 365 and Azure environment - things seem to go well until I ran into this issue
following along this guide connect-office-365 Seem to hit an issue doing this step
From the Data connectors gallery, select Office 365, and then select Open connector page on the preview pane. I fail the prerequisites Tenant Permissions: required 'Global Administrator' or 'Security Administrator' on the workspace's tenant. But I only have one single account that is 'Global Administrator' in my Azure Active Directory and listed as 'Global Administrator' in Azure
I am not sure what I have not setup -Anyone seen this before

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
996 questions
0 comments

5 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. JoyDutt 821 Reputation points
    2021-01-03T15:27:19.763+00:00

    Hi @Thomas Black

    Just a hint in my mind , while I check for other things..

    PRE REQ says:

    • Workspace: read and write permissions are required.
    • Tenant Permissions: required ‘Global Administrator’ or ‘Security Administrator’ on the workspace’s tenant.
    • License:Office 365 ATP Plan 2 --You are setting up *Test * so your plan ?

    (If this reply was helpful please don't forget to Upvote and/or Accept as an answer, Thank You)

    Regards,
    J.D.

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    0 comments
  2. Thomas Black 1 Reputation point
    2021-01-03T15:59:07.743+00:00

    Hello
    thanks for getting back to me I have Microsoft 365 Business Premium licence allocated to this account

  3. Thomas Black 1 Reputation point
    2021-01-03T16:26:14.57+00:00

    Hello
    I have sign-out and confirmed that I am global admin in 0365 admin centre
    I have also tried incognito/private mode
    Most only have one tenant - liked Azure to my 0365

    0 comments
  4. Thomas Black 1 Reputation point
    2021-01-03T21:03:58.033+00:00

    An update
    I created a secondary account for my test environment and it worked
    so the issue is something to do with the original account
    Not sure what to do next

    0 comments
  5. JamesTran-MSFT 36,476 Reputation points Microsoft Employee
    2021-01-04T23:24:18.27+00:00

    @Thomas Black
    Thank you for your post!

    Based off your error message and the pre-requisites, can you make sure that you're either a Global Admin or Security Admin within your Tenant.

    53355-image.png

    Error message:
    Tenant Permissions: required 'Global Administrator' or 'Security Administrator' on the workspace's tenant.

    Next Steps:

    1. Navigate to the Azure Portal - https://portal.azure.com/
    2. Confirm you're in the Tenant that is hosting your Azure Sentinel Workspace
      53369-image.png
    3. Search for Azure Active Directory
      53427-image.png
    4. Select Users -> Choose your user -> Select "Assigned Roles" -> Confirm that your user is a Global Admin of that tenant.
      53378-image.png

    If you're still running into issues or have any other questions, please let me know.
    Thank you for your time and patience throughout this issue.

    ----------

    Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.