Forum Discussion

kinomakino's avatar
kinomakino
MCT
Aug 22, 2025

I have no Microsoft Office 365 logs.

First of all, thanks in advance.

In one tenant, I've configured Sentinel with several data sources, but the Microsoft 365 connector isn't logging events.

I've done this about 20 times for different clients.
The connector appears connected.
I disconnected the connector and deleted the resource from the content center.
Of course, I've waited; it's been a month since I did it the first time.
I've tried checking Exchante, Teams, etc., to test combinations.

I don't know if you know of any way to troubleshoot, see why the logs aren't arriving? Do I need to do something in Microsoft 365? Auditing is enabled, because when I go to Purview, audit, I can search for logs.

I can't think of anything else.

Thanks!!!

data collection

1 Reply

  • Surya_Narayana's avatar
    Surya_Narayana
    MCT
    Aug 25, 2025

    hi  kinomakino​ If the Microsoft 365 connector in Sentinel is connected but no logs are flowing, check these points:

    1. Audit Log Retention – Verify Unified Audit Logging is enabled in the tenant (Get-AdminAuditLogConfig | FL UnifiedAuditLogIngestionEnabled). Even if you see logs in Purview, ingestion to Sentinel requires this setting.
    2. Permissions – The account used for the connector needs the correct roles (Security Reader and Global Reader or equivalent in Azure AD / M365 Compliance).
    3. Connector Configuration – Ensure you selected the right log types (Exchange, SharePoint, Teams, etc.) in the Sentinel connector blade.
    4. Region Latency – M365 → Sentinel ingestion can take up to 24 hours initially. Since it’s been a month, this is not normal.
    5. Check Diagnostics – In Sentinel, open the Office 365 (Preview) connector health in the Logs (KQL) pane and run:

    OfficeActivity

    | take 10

    If it’s empty, ingestion isn’t working.

    6.Connector Reset – Fully remove the connector (including its underlying Office 365 Management API subscription), then re-add it. Sometimes the subscription gets stuck.

    7.Microsoft Known Issues – Check the Service Health Dashboard in M365 Admin Center for connector ingestion issues.

     If audit logs are visible in Purview but not Sentinel, the most common culprits are:

    • Unified Audit Log ingestion disabled in the backend.
    • Stale or broken API subscription between Sentinel and Office 365.

     

Resources