Forum Discussion

Andre_de_Koning's avatar
Andre_de_Koning
Copper Contributor
Mar 04, 2019

Cannot install any dashboards

Hi guys,   I am getting started with Azure Sentinel and have configured all my data sources and see information coming in.   However, when I try to install any of the related dashboards I get the...
  • landau07's avatar
    landau07
    Mar 05, 2019

    Hi,

     

    Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register.

     

    Thanks,

    Yaron

Orco365's avatar
Orco365
Icon for Microsoft rankMicrosoft
Mar 04, 2019

hi Andre, 

can you pls share the workspace id?

 

also - which dashboard do you try to install?

 

thanks,

Or

Andre_de_Koning's avatar
Andre_de_Koning
Copper Contributor
Mar 04, 2019

The log analytics workspace ID is 32335b41-c510-4897-91c7-d4177d8ff5e9

I've tried to install ALL of them :)

Specifically: Azure Activity, AAD Audit Logs, AAD Sing-in logs, Identity & Access, Office 365...

The required data types for all of them show a green check and for each I did check that the data sources have been configured and are working.

I am using PIM but elevate to both Global Admin and Azure subscription Owner before using Sentinel. 

The environment is CSP licensed. I've tried excluding traffic from MCAS but to no avail (I've had numerous problems in Log Analytics when MCAS proxied so this is the first thing I thought of).

 

  • landau07's avatar
    landau07
    Icon for Microsoft rankMicrosoft
    Mar 05, 2019
    Hi,

    Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register again.

    Thanks,
    Yaron
    • Andy Hurren's avatar
      Andy Hurren
      Icon for Microsoft rankMicrosoft
      Mar 13, 2019

      Hitting the same issue. I can see the Microsoft.Portal resource provider is registered OK.

      I'm trying to unregister it however the process is unresponsive. The unregister hyperlink links to "https://portal.azure.com"  Any pointers on what I can do to unregister/re-register the provider?

       

      • Andy Hurren's avatar
        Andy Hurren
        Icon for Microsoft rankMicrosoft
        Mar 14, 2019

        Resolved. Checked AAD logs and error is due to using an unsupported region.

  • aaronclegg's avatar
    aaronclegg
    Copper Contributor
    Mar 05, 2019

    Hi

     

    I have deployed a Sentinel workspace this morning and I am getting the same problem.  All dashboards I try and add give the same error, I am using a regular global admin user.

     

    Aaron

    • landau07's avatar
      landau07
      Icon for Microsoft rankMicrosoft
      Mar 05, 2019

      Hi,

       

      Please go to the subscription resource of the workspace -> select ResourceProviders tab -> search for 'Microsoft.Portal' -> Make sure it is Register. If not, try unregister and register.

       

      Thanks,

      Yaron

      • Andre_de_Koning's avatar
        Andre_de_Koning
        Copper Contributor
        Mar 05, 2019
        Thanks, you're a star, problem solved :)
        For some reason it was not registered at all. Seems to be CSP related. I tested in my MSDN subs and it happened automatically. I tested again in another CSP subs and same problem, provider not registered.

Resources