Forum Discussion

yugandhar206's avatar
yugandhar206
Copper Contributor
Jun 25, 2025

Not showing GWorkspaceActivityReports Table in Sentinel

Hello,

We have integrated Google Workspace with MS Sentinel through Azure function ARM template and both the functions https://portal.azure.com/#blade/WebsitesExtension/FunctionTabMenuBlade/resourceId/%2Fsubscriptions%2Ffb6bab92-56b8-4746-a043-112b266d9214%2FresourceGroups%2Ffjet-wus-mgmt-rg%2Fproviders%2FMicrosoft.Web%2Fsites%2Fgworkspace7e5lesxnx6qmw%2Ffunctions%2FGWorkspaceReports-QueueTrigger and https://portal.azure.com/#blade/WebsitesExtension/FunctionTabMenuBlade/resourceId/%2Fsubscriptions%2Ffb6bab92-56b8-4746-a043-112b266d9214%2FresourceGroups%2Ffjet-wus-mgmt-rg%2Fproviders%2FMicrosoft.Web%2Fsites%2Fgworkspace7e5lesxnx6qmw%2Ffunctions%2FGWorkspaceReports-TimeTrigger showing fetching Google workspace events but the connector is showing disconnected and could not find any relative table in the Sentinel workspace.

Please help us on this to fetch Google workspace events.

 

 

 

 

 

 

 

 

 

 

 

Thanks,

Yugandhar.

integration

1 Reply

  • Ankit's avatar
    Ankit
    Brass Contributor
    Aug 07, 2025

    Hi 

     

    The “Disconnected” status on the Google Workspace connector in Microsoft Sentinel means Sentinel has not received any data from the connector yet, which is why you don’t see any related tables in your Sentinel workspace. Even though your Azure Functions (GWorkspaceReports-QueueTrigger and GWorkspaceReports-TimeTrigger) show that they are fetching Google Workspace events, it’s likely they are not successfully sending this data to the Sentinel workspace. This problem usually happens because of one or more of the following reasons: the Azure Function’s workspace ID or key is incorrect or mismatched in the function’s application settings; the Google service account being used does not have the proper permissions or API scopes to access Google Workspace reports; or the functions are encountering errors when trying to send data, which you can confirm by checking the Azure Function logs in the portal. 

    To fix this, first verify that the workspace ID and key configured in your Azure Function match exactly with your Sentinel Log Analytics workspace details. Next, ensure the Google service account has the correct delegated domain-wide authority with the needed API scopes (like Reports API and Admin SDK) and that those APIs are enabled in Google Cloud. Also, review the Azure Function logs for any errors related to ingestion or API access. Until data successfully flows from the Azure Functions into the Sentinel workspace, the connector will remain “Disconnected” and no tables (such as GWorkspaceReports_CL) will appear. By carefully checking and fixing these points, you will be able to start receiving Google Workspace events in Sentinel.

     

    let me know if this helps !

     

     

Resources