Forum Discussion

-jmn-'s avatar
-jmn-
Copper Contributor
Dec 16, 2022

"failed to apply changes" - Onboarding Azure AD Logs Into Sentinel

Whenever we try to onboard Azure Active Directory logs into Sentinel, we get a very unhelpful error message "failed to apply changes - error". We have tried this twice, a week apart. How can this be ...
data collection
siem
GBushey's avatar
GBushey
Icon for Microsoft rankMicrosoft
Dec 21, 2022
I would go into AAD and setup the Diagnostic settings to send data into Sentinel's Log Analytics workspace.
  • -jmn-'s avatar
    -jmn-
    Copper Contributor
    Jan 05, 2023
    I tried this. It actually gave me an error this time. It said I was missing a P1 or P2 license. I have a P1 license. Out of curiosity, I clicked on the offer of a free trial. It did not give me the option to purchase a P1 license (because I have them).

    I think the issue is the following: The Azure subscription that the LA workspace resides in belongs to a security administrator at the org. AAD is provided through a reseller. I think the error could be fixed by redeploying in an Azure subscription provided by the reseller.

Resources