Office 365 connected but no logs.

Question

My office 365 says its connected, but no longs are coming into Sentinel..&nbsp;&nbsp;

kjetil skjørvestad · Answer

Uri Arjitecter over at https://techcommunity.microsoft.com/t5/Azure-Sentinel/Connect-to-Azure-Active-Directory/m-p/360557/highlight/true#M56&nbsp;had the answer for me.Needed to enable integrate Azure AD Logs with Log Analytics https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analyticsand it now works fine.&nbsp;Thanks Uri Arjitecter&nbsp;

thoford · Answer

After 5 hours data finally seems to be arriving

kjetil skjørvestad · Answer

Behavior from my testing so far:O365 says "Configure" instead of "connected," but I seem to get data.Maybe it needs to catch up to a certain level before it changes status. Connected for 6ish hours so far. -Azure AD Identity Protection got to status Connected in secondsAzure Active Directory have been "connecting" from at least 5 hours nowCant see any data from it yet. I'll just leave it until tomorrow and see if anything changes.

ryan heffernan · Answer

Thomas,&nbsp;
&nbsp;
Thanks for telling us about your experience. I'm adding&nbsp;Koby Koren and&nbsp;Shalini Pasupneti so they can note the issue and your feedback.&nbsp;

ryan heffernan · Answer

Kjetil,&nbsp;
&nbsp;
Thanks for the detailed feedback. We'll look into these issues (CC:&nbsp;Koby Koren and&nbsp;Shalini Pasupneti).&nbsp;

Forum Discussion

Office 365 connected but no logs.

9 Replies