Forum Discussion

Brass Contributor

Mar 01, 2019

Office 365 connected but no logs.

My office 365 says its connected, but no longs are coming into Sentinel..

Kjetil Skjørvestad

Copper Contributor

Mar 01, 2019

Behavior from my testing so far:

O365 says "Configure" instead of "connected," but I seem to get data.
- Maybe it needs to catch up to a certain level before it changes status. Connected for 6ish hours so far. -
Azure AD Identity Protection got to status Connected in seconds
Azure Active Directory have been "connecting" from at least 5 hours now
- Cant see any data from it yet. I'll just leave it until tomorrow and see if anything changes.

Icon for Microsoft rank

Microsoft

Mar 02, 2019

Kjetil,

Thanks for the detailed feedback. We'll look into these issues (CC: Koby Koren and Shalini Pasupneti).

Kjetil Skjørvestad
Copper Contributor
Mar 03, 2019
Thank you. I once in a while get this error while trying:

Experiencing authentication issues
The portal is having issues getting an authentication token. The experience rendered may be degraded. Additional information from the call to get a token: Extension: appinsightsextension Resource: loganalyticsapi Details: code: 0, statusText: error, message: ajaxExtended call failed, stack:

---
Data from O365 works very well while Azure AD just refuse to connect.
- Kjetil Skjørvestad
  Copper Contributor
  Mar 05, 2019
  Uri Arjitecter over at https://techcommunity.microsoft.com/t5/Azure-Sentinel/Connect-to-Azure-Active-Directory/m-p/360557/highlight/true#M56 had the answer for me.
  
  Needed to enable integrate Azure AD Logs with Log Analytics https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/howto-integrate-activity-logs-with-log-analyticsand it now works fine.
  
  Thanks Uri Arjitecter