Forum Discussion

Andre_de_Koning's avatar
Andre_de_Koning
Copper Contributor
Mar 04, 2019

Cannot install any dashboards

Hi guys,   I am getting started with Azure Sentinel and have configured all my data sources and see information coming in.   However, when I try to install any of the related dashboards I get the...
  • landau07's avatar
    landau07
    Mar 05, 2019

    Hi,

     

    Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register.

     

    Thanks,

    Yaron

Orco365's avatar
Orco365
Icon for Microsoft rankMicrosoft
Mar 04, 2019

hi Andre, 

can you pls share the workspace id?

 

also - which dashboard do you try to install?

 

thanks,

Or

  • Andre_de_Koning's avatar
    Andre_de_Koning
    Copper Contributor
    Mar 04, 2019

    The log analytics workspace ID is 32335b41-c510-4897-91c7-d4177d8ff5e9

    I've tried to install ALL of them :)

    Specifically: Azure Activity, AAD Audit Logs, AAD Sing-in logs, Identity & Access, Office 365...

    The required data types for all of them show a green check and for each I did check that the data sources have been configured and are working.

    I am using PIM but elevate to both Global Admin and Azure subscription Owner before using Sentinel. 

    The environment is CSP licensed. I've tried excluding traffic from MCAS but to no avail (I've had numerous problems in Log Analytics when MCAS proxied so this is the first thing I thought of).

     

    • landau07's avatar
      landau07
      Icon for Microsoft rankMicrosoft
      Mar 05, 2019
      Hi,

      Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register again.

      Thanks,
      Yaron
      • Andy Hurren's avatar
        Andy Hurren
        Icon for Microsoft rankMicrosoft
        Mar 13, 2019

        Hitting the same issue. I can see the Microsoft.Portal resource provider is registered OK.

        I'm trying to unregister it however the process is unresponsive. The unregister hyperlink links to "https://portal.azure.com"  Any pointers on what I can do to unregister/re-register the provider?

         

    • aaronclegg's avatar
      aaronclegg
      Copper Contributor
      Mar 05, 2019

      Hi

       

      I have deployed a Sentinel workspace this morning and I am getting the same problem.  All dashboards I try and add give the same error, I am using a regular global admin user.

       

      Aaron

      • landau07's avatar
        landau07
        Icon for Microsoft rankMicrosoft
        Mar 05, 2019

        Hi,

         

        Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register.

         

        Thanks,

        Yaron

Resources