Microsoft sentinel not ingesting M365 connector data

Question

Greetings, we have this situation where the data connector for M365 isn't ingesting logs to sentinel. The connector shows as connected, but no logs are being ingested

From the health data, they give this message: "Tenant does not exist in the O365 Management API." With the recommended action: "Unified auditing is not enabled for the tenant in O365. Enable unified auditing in O365."

The status code for this is: SC20011

I verified that unified auditing IS enabled in our tenant. This happens for all of the connector types, exchange, sharepoint, and teams. Any idea how to correct this issue? The Microsoft Entra ID connector, and the Azure Activity connector are working fine. It just seems to be an issue with M365

Answer 1

We managed to finally get this working. The problem was a back-end Microsoft issue. We were a GCC tenant "accidentally" created in the commercial tenant. (You can find this by going to admin.microsoft.com > settings > Organization profile > Data Location. (It should say Government Community Cloud if you are GCC... if it doesn't, you have a problem))

The Office 365 management API was utilizing the manage.office.com and not the manage-gcc.office.com. You can check specifically by creating an app registration and calling the manage-gcc.office.com using the Office 365 management API. If it does not exist in there, then that's your problem. After migrating from commercial to GCC (We did not submit a ticket for this, they happen to reach out and tell us specifically), and submitting a ticket for this API issue, they were able to change the back-end api to use the manage-gcc.office.com URL only after we had tried to escalate with O365 support multiple times. We had to get a larger company involved in getting this resolved as the O365 support wanted to punt us to the Entra support team which is a paid plan. No sense in paying for something when this was entirely not our fault. I hope this helps anyone who might have the same problem.

Answer 2

Still no resolution after re installation either. Not sure if GCC has anything to do to affect this.

I've disabled and re-enabled unified auditing, and reinstalling sentinel and making a new workgroup. Still nothing

Answer 3

Hello @Brandon DeVane,

After installing the Microsoft 365 (formerly Office 365) Data Connector, how long did you wait to check if the logs were being ingested? Typically, it can take 2–3 hours for the logs to start appearing.

Please wait at least 3 hours and verify if the logs are being ingested. If you're still not seeing any data, kindly share a screenshot of your connector page for further review.