Microsoft Sentinel UEBA – AWS CloudTrail data source fails to connect with HTTP 500

hi abeniwal73​ Based on the troubleshooting you've already done, I agree that this looks less like an AWS CloudTrail ingestion or permissions issue and more like something happening when the Sentinel UEBA configuration is being updated.

The strongest clue for me is that you can read the existing UEBA configuration successfully, but even an update that doesn't involve AWS CloudTrail returns the same HTTP 500 on Microsoft.SecurityInsights/settings/write.

Since the Activity Log also shows InternalServerError rather than AuthorizationFailed or RequestDisallowedByPolicy, I'd be inclined to investigate the Sentinel/UEBA backend rather than spending more time on the AWS connector.

If you haven't already, I would capture the correlation ID, timestamp, workspace/resource ID, and the exact API request/response from one of the failed updates and provide those to Microsoft Support. Those details should give the Sentinel engineering team something concrete to trace on the backend.

It may also be worth testing the same configuration update through the API using the documented API version, just to rule out a portal-specific issue. Since you've already seen the same 500 through the API, though, that would further strengthen the case that this is service-side.

I'd be interested to hear from anyone else using the new Unified SecOps/Defender experience whether UEBA configuration updates are currently working for them. If multiple workspaces are seeing the same settings/write 500, it would certainly point toward a backend issue rather than the AWS configuration.