Share via

Microsoft Sentinel P1/P2 license

David Eyles 1 Reputation point
2022-02-17T10:03:34.24+00:00

For my customer we are trialing MS Sentinel and trying to connector their AD signin logs but does not seem to connect.

Audit logs are working fine.

So we know we need a P1 or P2 license and that the AD P1 is provided by the M365 Business Premium licenses they have, but still no signin data is connecting or available in Sentinel.

Any ideas why?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,123 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Givary-MSFT 32,311 Reputation points Microsoft Employee
    2022-02-17T12:21:59.217+00:00

    @David Eyles

    Thank you reaching out to us. I agree to your statement if you have P1 license, you should be able to ingest sign-in logs into sentinel

    Also check the user who is configuring the data connector is Global Admin/Security Admin Role & P1/P2 license assigned to the user.

    Also query Log Analytics Workspace for Sign-in logs ?

    SigninLogs
    | take 1000
    | sort by TimeGenerated

  2. Andrew Blumhardt 9,856 Reputation points Microsoft Employee
    2022-02-17T12:23:40.17+00:00

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.