Forum Discussion
Azure ATP connection closed errors
you can work with a demo environment without any issues.
back to the log, you've some error with: the underlying connection was closed... and that means you've some issue with a connection from your local DC's to the AATP, it could be a connectivity issue, some SSL inspection or even firewall port.
from the tri logs, it looks like the sensor isn't stable and restarting, below a few points to check:
Make sure Azure ATP Prerequisites is
Did you saw outbound connection limit or network issues from DC's to AATP
Make sure your DC's are healthy and connected (on AATP console)
Do you've some SSL inspection or proxy to the internet?
To simulate an attack scenario with AATP, it will be better with two Windows client (one victim and one attacker).
Hi and thanks for your reply, I have checked all prerequisites.
1. server is helathy
2. No Sensor errors in ATP portal
3. Sensor is listed
I deleted the ATP instance and created one from scratch. however when I try to connect: https://m365x727487sensorapi.atp.azure.com/
Note: m365x727487 is the name of my demo tenannt, i get
HTTP Error 503. The service is unavailable.
After I have setup the instance, I can browser domain specific objects, so it looks like some information is flowing up correctly.
- EliOfek
Microsoft
503 is normal when using a browser.
Something is blocking the connection.
Notice that the services are running under local service & local system,
so they might be getting a different policy compared to your logged in user...
Any chance they are getting some proxy settings via policy that keeps blocking it ?
Hi, there's no proxy in place, this is a very simple setup, the DC runs in a VM on my notebook that has direct internet connection via my home ISP connection.
But meanwhile I found another article regarding the use of ATP for tenants created via demos.microsoft.com maybe that could be the issue?
