Share via

Microsoft Sentinel P1/P2 license

David Eyles 1 Reputation point
2022-02-17T10:03:34.24+00:00

For my customer we are trialing MS Sentinel and trying to connector their AD signin logs but does not seem to connect.

Audit logs are working fine.

So we know we need a P1 or P2 license and that the AD P1 is provided by the M365 Business Premium licenses they have, but still no signin data is connecting or available in Sentinel.

Any ideas why?

Microsoft Security | Microsoft Sentinel
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator
    2022-02-17T12:21:59.217+00:00

    @David Eyles

    Thank you reaching out to us. I agree to your statement if you have P1 license, you should be able to ingest sign-in logs into sentinel

    Also check the user who is configuring the data connector is Global Admin/Security Admin Role & P1/P2 license assigned to the user.

    Also query Log Analytics Workspace for Sign-in logs ?

    SigninLogs
    | take 1000
    | sort by TimeGenerated

  2. Andrew Blumhardt 10,051 Reputation points Microsoft Employee
    2022-02-17T12:23:40.17+00:00

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.