This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 11%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
We have automatic processes creating the Azure sentinel watchlists. On Saturday, the processes were launched but something happened because we have three watchlists is a strange state. And now It is impossible to delete them using the console. The error is “Cannot delete watchlist 'XXXXXXX'. Upload is currently in progress.”.
On the other hand, after this problem, when i try to create a new watchlist using api the result is: “Internal server Error”.
I don't know what is happening. There seems to be a state of inconsistency.
Can you help me?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 81%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMT%3C/text%3E%3C/svg%3E)
Thanks for reporting this! The error is new to me so I have reached out to the Sentinel team for a solution. Automating certain connectors via service principal is not something that Sentinel supports today. Those are connectors that need Azure AD level permissions (instead of Azure-only permissions). There's work ongoing to enabling this scenario, but as of now, you will have to enable those connector with your user identity..
I am waiting on a response from the Sentinel team and will post back to you as soon as I hear back.
Our processes are azure functions. Once a week, our azure functions move the data from a Database to our watchlist. The problem is that something happened in the last process. Our watchlists went to a strange state and now cannot be deleted.
On the other hand. I don’t know the reason but our client's sentinel environment is in a state of inconsistency.
I am trying to create a watchlist from the api:
https://learn.microsoft.com/en-us/rest/api/securityinsights/watchlists/create-or-update#code-try-0
simple test in our client's subscription
ERROR 500. "message": "{\"Message\":\"An error has occurred.\"}"
the same simple test in a trial subscription
OK 200
I don’t know the reason but our client's sentinel environment is in a state of inconsistency.
Thank you for the details. Could you provide a HAR for this? This might need to go to a support case as my PG contacts also have not seen this. If you send me an email at AzCommunity@microsoft.com (Attn: Marilee Turscak) I can open a free support case for you.
More than two weeks with this problem in the production environment. Please, can someone help us? . We opened a case weeks ago, but they don't solve ANYTHING.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(38.4, 23%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETN%3C/text%3E%3C/svg%3E)
Did you find a solution?
I'm having the same issue