Home

Office 365 connected but no logs.

%3CLINGO-SUB%20id%3D%22lingo-sub-358885%22%20slang%3D%22en-US%22%3EOffice%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358885%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20office%20365%20says%20its%20connected%2C%20but%20no%20longs%20are%20coming%20into%20Sentinel..%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-361143%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-361143%22%20slang%3D%22en-US%22%3E%3CP%3EConnected%20Office%20365%20activity%20log%20connector%20over%2048h%20ago%2C%20still%20no%20data.%3C%2FP%3E%3CP%3EThis%20is%20true%20for%20our%20tenant%20only%20(Pay-as-you-go).%26nbsp%3B%20For%20two%20other%20tenants%20(CSP%20Subscriptions)%20it%20seems%20to%20work.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20available%20for%20troubleshooting%20if%20any%20Microsoft%20peeps%20are%20interested.%20PM%20me%20or%20email%20me.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360919%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360919%22%20slang%3D%22en-US%22%3E%3CP%3EUri%20Arjitecter%20over%20at%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FConnect-to-Azure-Active-Directory%2Fm-p%2F360557%2Fhighlight%2Ftrue%23M56%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FConnect-to-Azure-Active-Directory%2Fm-p%2F360557%2Fhighlight%2Ftrue%23M56%26nbsp%3B%3C%2FA%3Ehad%20the%20answer%20for%20me.%3CBR%20%2F%3E%3CBR%20%2F%3ENeeded%20to%20enable%20integrate%20Azure%20AD%20Logs%20with%20Log%20Analytics%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Fhowto-integrate-activity-logs-with-log-analytics%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Fhowto-integrate-activity-logs-with-log-analytics%26nbsp%3B%3C%2FA%3Eand%20it%20now%20works%20fine.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F195410%22%20target%3D%22_blank%22%3E%40Uri%20Arjitecter%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360173%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360173%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20O365%20data%20has%20populated%20overnight%20%2F%20within%2024hrs.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359872%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359872%22%20slang%3D%22en-US%22%3E%3CP%3ESame%20issue%20here%2C%26nbsp%3B%20I%20will%20give%20a%20day%20and%20check%20on%20it%20tomorrow.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359629%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359629%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you.%20I%20once%20in%20a%20while%20get%20this%20error%20while%20trying%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-title%22%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-title-text%20msportalfx-tooltip-overflow%22%3E%3CEM%3EExperiencing%20authentication%20issues%3C%2FEM%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E%3CEM%3EThe%20portal%20is%20having%20issues%20getting%20an%20authentication%20token.%20The%20experience%20rendered%20may%20be%20degraded.%20Additional%20information%20from%20the%20call%20to%20get%20a%20token%3A%20Extension%3A%20appinsightsextension%20Resource%3A%20loganalyticsapi%20Details%3A%20code%3A%200%2C%20statusText%3A%20error%2C%20message%3A%20ajaxExtended%20call%20failed%2C%20stack%3A%3C%2FEM%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E---%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3EData%20from%20O365%20works%20very%20well%20while%20Azure%20AD%20just%20refuse%20to%20connect.%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359450%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359450%22%20slang%3D%22en-US%22%3E%3CP%3EKjetil%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20the%20detailed%20feedback.%20We'll%20look%20into%20these%20issues%20(CC%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F187254%22%20target%3D%22_blank%22%3E%40Koby%20Koren%3C%2FA%3E%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F16203%22%20target%3D%22_blank%22%3E%40Shalini%20Pasupneti%3C%2FA%3E).%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359449%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359449%22%20slang%3D%22en-US%22%3E%3CP%3EThomas%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20telling%20us%20about%20your%20experience.%20I'm%20adding%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F187254%22%20target%3D%22_blank%22%3E%40Koby%20Koren%3C%2FA%3E%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F16203%22%20target%3D%22_blank%22%3E%40Shalini%20Pasupneti%3C%2FA%3E%20so%20they%20can%20note%20the%20issue%20and%20your%20feedback.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358922%22%20slang%3D%22en-US%22%3ERE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358922%22%20slang%3D%22en-US%22%3E%3CP%3EBehavior%20from%20my%20testing%20so%20far%3A%3C%2FP%3E%3CUL%3E%3CLI%3EO365%20says%20%22Configure%22%20instead%20of%20%22connected%2C%22%20but%20I%20seem%20to%20get%20data.%3CUL%3E%3CLI%3EMaybe%20it%20needs%20to%20catch%20up%20to%20a%20certain%20level%20before%20it%20changes%20status.%20Connected%20for%206ish%20hours%20so%20far.%20-%3C%2FLI%3E%3C%2FUL%3E%3C%2FLI%3E%3CLI%3EAzure%20AD%20Identity%20Protection%20got%20to%20status%20Connected%20in%20seconds%3C%2FLI%3E%3CLI%3EAzure%20Active%20Directory%20have%20been%20%22connecting%22%20from%20at%20least%205%20hours%20now%3CUL%3E%3CLI%3ECant%20see%20any%20data%20from%20it%20yet.%20I'll%20just%20leave%20it%20until%20tomorrow%20and%20see%20if%20anything%20changes.%3C%2FLI%3E%3C%2FUL%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358898%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358898%22%20slang%3D%22en-US%22%3EAfter%205%20hours%20data%20finally%20seems%20to%20be%20arriving%3C%2FLINGO-BODY%3E
Thomas Førde
Occasional Contributor

My office 365 says its connected, but no longs are coming into Sentinel..

 

 

9 Replies
After 5 hours data finally seems to be arriving

Behavior from my testing so far:

  • O365 says "Configure" instead of "connected," but I seem to get data.
    • Maybe it needs to catch up to a certain level before it changes status. Connected for 6ish hours so far. -
  • Azure AD Identity Protection got to status Connected in seconds
  • Azure Active Directory have been "connecting" from at least 5 hours now
    • Cant see any data from it yet. I'll just leave it until tomorrow and see if anything changes.

Thomas, 

 

Thanks for telling us about your experience. I'm adding @Koby Koren and @Shalini Pasupneti so they can note the issue and your feedback. 

Kjetil, 

 

Thanks for the detailed feedback. We'll look into these issues (CC: @Koby Koren and @Shalini Pasupneti). 

Thank you. I once in a while get this error while trying:

 

Experiencing authentication issues
The portal is having issues getting an authentication token. The experience rendered may be degraded. Additional information from the call to get a token: Extension: appinsightsextension Resource: loganalyticsapi Details: code: 0, statusText: error, message: ajaxExtended call failed, stack:
 
---
Data from O365 works very well while Azure AD just refuse to connect.

Same issue here,  I will give a day and check on it tomorrow. 

My O365 data has populated overnight / within 24hrs. 

Connected Office 365 activity log connector over 48h ago, still no data.

This is true for our tenant only (Pay-as-you-go).  For two other tenants (CSP Subscriptions) it seems to work.

 

I'm available for troubleshooting if any Microsoft peeps are interested. PM me or email me.

 

Related Conversations
Tabs and Dark Mode
cjc2112 in Discussions on
46 Replies
Extentions Synchronization
Deleted in Discussions on
3 Replies
Stable version of Edge insider browser
HotCakeX in Discussions on
35 Replies
flashing a white screen while open new tab
Deleted in Discussions on
14 Replies
How to Prevent Teams from Auto-Launch
chenrylee in Microsoft Teams on
29 Replies
Security Community Webinars
Valon_Kolica in Security, Privacy & Compliance on
13 Replies