Microsoft sentinel not ingesting M365 connector data

Question

Microsoft sentinel not ingesting M365 connector data

Brandon DeVane 0

Greetings, we have this situation where the data connector for M365 isn't ingesting logs to sentinel. The connector shows as connected, but no logs are being ingested

From the health data, they give this message: "Tenant does not exist in the O365 Management API." With the recommended action: "Unified auditing is not enabled for the tenant in O365. Enable unified auditing in O365."

The status code for this is: SC20011

I verified that unified auditing IS enabled in our tenant. This happens for all of the connector types, exchange, sharepoint, and teams. Any idea how to correct this issue? The Microsoft Entra ID connector, and the Azure Activity connector are working fine. It just seems to be an issue with M365

Raja Pothuraju 22,475 Reputation points Microsoft External Staff Moderator

2025-05-08T00:06:47.3+00:00

Hello @Brandon DeVane,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Your answer

Raja Pothuraju 22,475 Reputation points Microsoft External Staff Moderator

2025-05-08T00:06:47.3+00:00

Hello @Brandon DeVane,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 1

Raja Pothuraju 22,475 Microsoft External Staff Moderator

Hello @Brandon DeVane,

After installing the Microsoft 365 (formerly Office 365) Data Connector, how long did you wait to check if the logs were being ingested? Typically, it can take 2–3 hours for the logs to start appearing.

Please wait at least 3 hours and verify if the logs are being ingested. If you're still not seeing any data, kindly share a screenshot of your connector page for further review. User's image

bdevane 0 Reputation points

2025-05-12T15:09:53.1533333+00:00

Hello, the connector has been online for more than a week. Logs still are not being ingested.

I also confirmed logs are showing up for exchange/sharepoint in the audit section of the security admin page. Not sure why it does not get to sentinel
Raja Pothuraju 22,475 Reputation points Microsoft External Staff Moderator

2025-05-14T21:59:08.7266667+00:00

Hello @bdevane,

Thank you for your response.

If you're still experiencing the issue, I recommend reinstalling the Microsoft 365 (formerly Office 365) data connector in your portal. You can do this by deleting the existing connector and then reinstalling it from the Content Hub.

Please let me know if the issue persists after reinstallation.

Share via

Microsoft sentinel not ingesting M365 connector data

1 answer

Your answer