Forum Discussion

brlgen's avatar
brlgen
Brass Contributor
Jul 10, 2023

IdentityLogonEvents stays empty after deploying MDI

I have recently deployed MDI in two different environments/tenants, one almost a month ago and the other last week however this table is completely empty:

IdentityLogonEvents

 

Additionally, filtering the "Identities" page for the AD "app" shows no result. The sensor is up to date and has a healthy status. The identity posture page on the "legacy" Defender for Cloud apps does show data concerning LDAP cleartext, RC4 usage...

 

In fact all tables under Apps & Identities are empty except for:

IdentityInfo
 

This seems to be very similar issue from a while ago:

https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/missing-events-in-identitylogonevents-table-since-26-november-6/m-p/3687903

 

microsoft 365 defender
Sensor
  • Or Tsemah's avatar
    Or Tsemah
    Icon for Microsoft rankMicrosoft
    Jul 24, 2023
    Hi, is it still empty, if so, please open a support ticket so we can troubleshoot it.
    • brlgen's avatar
      brlgen
      Brass Contributor
      Jul 27, 2023
      I did and this seemed to be a global issue and has been resolved now, thanks.

Resources