Forum Discussion
Regarding O365 connector
chinmoyJ Teams ingestion is still in preview and not generally available so the article is still the best way to get the information as of right now.
GaryBushey Can you please share the article/docs reference so that I can share with management that TEAMS ingestion is still in the preview? I looked up the "docs" content for the O365 connector and couldn't find it:(
Ref:https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365
- Ofer_Shezaf
Microsoft
Not sure I follow. Let's try to summarize:
- The official Office 365 connector does not support Teams yet. As GaryBushey mentioned, this is in private preview. I can hardly share a document saying something does not yet exist...
- The solution you are using is a community solution. We would love to try to help you here to make it work, however support may not have all information on it.
Sorry for the late revert, Ofer_Shezaf . The challenge was that I was not across the document shared by MS with our organization and thus was not aware of the "TEAMS" private feature. With the public document available online i.e https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365 there was no mention of the "TEAMS" preview thing. Thus, requested GaryBushey to update the docs public article for clarity. Now, that I have gone through the internal document on the "TEAMS" connector (private release) I understand why it's not mentioned on the Docs link. I was recently onboarded to the sentinel project and didn't set up the connector & nor was across the private preview doc so was living in the assumption that it's out of the box, my bad! Also, the "Addon-Name" column is concluded as a bug by support team so looking fwd to getting it fixed 🙂
GaryBushey Thank you for the details, I have been using the O365 connector to fetch the TEAMS data and seeing some inconsistency with the data. The "Add-OnName" column is coming blank. Thus, opened the ticket with MS support. The support team came up with the suggestion to use the methods in the blog. I have requested the Ms support team to do a repro, and check on their end if its a bug (getting the blank Add-onName column, no values in it). Just wanted to rule out that data at source(O365 compliance-audit logs) are generating the values for "Add-On name" column. If not, then no point looking into the way how we are ingesting the data(blog options).
