Office 365 connector

Question

Hello&nbsp;I am able to connect Azure AD to Sentinel and i can see audit and log in data from Azure AD, however i am not getting any data from O365. I can connect O365 to Azure Sentinel but i dont see any data. When i look at the template i get the below error message . I have already tired deleting the O365 workbook and disconnecting the connector, and reconnecting it, but i still run into the same issue&nbsp;"This query could not run because some parameters are not set.Please set: Workload, UserType"

garybushey · Answer

Skipster&nbsp;The error is referring to the parameters drop down at the top of the workbook.&nbsp; There is a TimeRange, Workload, and UserType drop down and all three will need to be set.

skipster · Answer

GaryBusheyHi Gary&nbsp;I dont have those options. See screen shot

garybushey · Answer

Skipster&nbsp;They are the two drop downs that have the red dot next to them

skipster · Answer

GaryBusheyUnderstood, however there is nothing to select in the drop down. It just says query failed

garybushey · Answer

Skipster&nbsp;OK, now I get it.&nbsp; &nbsp;Those drop downs are looking for the "OfficeActivity" table which brings you back to your original statement about not having the data.&nbsp; Sorry for all the confusion.&nbsp;BTW, deleting the workbook won't really do anything, it is the connector that is needed.&nbsp; You said you have it connected and it states it is connected.&nbsp; When you click on the Office 365 data connector, in the details pane on the right side, is there anything listed in the Data Received graph?

Forum Discussion

Office 365 connector

Share

Resources