Home

Office 365 connected but no logs.

%3CLINGO-SUB%20id%3D%22lingo-sub-358885%22%20slang%3D%22en-US%22%3EOffice%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358885%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20office%20365%20says%20its%20connected%2C%20but%20no%20longs%20are%20coming%20into%20Sentinel..%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-361143%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-361143%22%20slang%3D%22en-US%22%3E%3CP%3EConnected%20Office%20365%20activity%20log%20connector%20over%2048h%20ago%2C%20still%20no%20data.%3C%2FP%3E%3CP%3EThis%20is%20true%20for%20our%20tenant%20only%20(Pay-as-you-go).%26nbsp%3B%20For%20two%20other%20tenants%20(CSP%20Subscriptions)%20it%20seems%20to%20work.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20available%20for%20troubleshooting%20if%20any%20Microsoft%20peeps%20are%20interested.%20PM%20me%20or%20email%20me.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360919%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360919%22%20slang%3D%22en-US%22%3E%3CP%3EUri%20Arjitecter%20over%20at%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FConnect-to-Azure-Active-Directory%2Fm-p%2F360557%2Fhighlight%2Ftrue%23M56%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3Ehttps%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2FAzure-Sentinel%2FConnect-to-Azure-Active-Directory%2Fm-p%2F360557%2Fhighlight%2Ftrue%23M56%26nbsp%3B%3C%2FA%3Ehad%20the%20answer%20for%20me.%3CBR%20%2F%3E%3CBR%20%2F%3ENeeded%20to%20enable%20integrate%20Azure%20AD%20Logs%20with%20Log%20Analytics%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Fhowto-integrate-activity-logs-with-log-analytics%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Freports-monitoring%2Fhowto-integrate-activity-logs-with-log-analytics%26nbsp%3B%3C%2FA%3Eand%20it%20now%20works%20fine.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F195410%22%20target%3D%22_blank%22%3E%40Uri%20Arjitecter%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-360173%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-360173%22%20slang%3D%22en-US%22%3E%3CP%3EMy%20O365%20data%20has%20populated%20overnight%20%2F%20within%2024hrs.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359872%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359872%22%20slang%3D%22en-US%22%3E%3CP%3ESame%20issue%20here%2C%26nbsp%3B%20I%20will%20give%20a%20day%20and%20check%20on%20it%20tomorrow.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359629%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359629%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you.%20I%20once%20in%20a%20while%20get%20this%20error%20while%20trying%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-title%22%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-title-text%20msportalfx-tooltip-overflow%22%3E%3CEM%3EExperiencing%20authentication%20issues%3C%2FEM%3E%3C%2FDIV%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E%3CEM%3EThe%20portal%20is%20having%20issues%20getting%20an%20authentication%20token.%20The%20experience%20rendered%20may%20be%20degraded.%20Additional%20information%20from%20the%20call%20to%20get%20a%20token%3A%20Extension%3A%20appinsightsextension%20Resource%3A%20loganalyticsapi%20Details%3A%20code%3A%200%2C%20statusText%3A%20error%2C%20message%3A%20ajaxExtended%20call%20failed%2C%20stack%3A%3C%2FEM%3E%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3E---%3C%2FDIV%3E%3CDIV%20class%3D%22fxs-notificationmenu-notification-description%20fxs-portal-title%20msportalfx-tooltip-overflow%20fxs-notificationmenu-notification-expandedDescription%22%3EData%20from%20O365%20works%20very%20well%20while%20Azure%20AD%20just%20refuse%20to%20connect.%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359450%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359450%22%20slang%3D%22en-US%22%3E%3CP%3EKjetil%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20the%20detailed%20feedback.%20We'll%20look%20into%20these%20issues%20(CC%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F187254%22%20target%3D%22_blank%22%3E%40Koby%20Koren%3C%2FA%3E%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F16203%22%20target%3D%22_blank%22%3E%40Shalini%20Pasupneti%3C%2FA%3E).%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-359449%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-359449%22%20slang%3D%22en-US%22%3E%3CP%3EThomas%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20telling%20us%20about%20your%20experience.%20I'm%20adding%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F187254%22%20target%3D%22_blank%22%3E%40Koby%20Koren%3C%2FA%3E%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F16203%22%20target%3D%22_blank%22%3E%40Shalini%20Pasupneti%3C%2FA%3E%20so%20they%20can%20note%20the%20issue%20and%20your%20feedback.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358922%22%20slang%3D%22en-US%22%3ERE%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358922%22%20slang%3D%22en-US%22%3E%3CP%3EBehavior%20from%20my%20testing%20so%20far%3A%3C%2FP%3E%3CUL%3E%3CLI%3EO365%20says%20%22Configure%22%20instead%20of%20%22connected%2C%22%20but%20I%20seem%20to%20get%20data.%3CUL%3E%3CLI%3EMaybe%20it%20needs%20to%20catch%20up%20to%20a%20certain%20level%20before%20it%20changes%20status.%20Connected%20for%206ish%20hours%20so%20far.%20-%3C%2FLI%3E%3C%2FUL%3E%3C%2FLI%3E%3CLI%3EAzure%20AD%20Identity%20Protection%20got%20to%20status%20Connected%20in%20seconds%3C%2FLI%3E%3CLI%3EAzure%20Active%20Directory%20have%20been%20%22connecting%22%20from%20at%20least%205%20hours%20now%3CUL%3E%3CLI%3ECant%20see%20any%20data%20from%20it%20yet.%20I'll%20just%20leave%20it%20until%20tomorrow%20and%20see%20if%20anything%20changes.%3C%2FLI%3E%3C%2FUL%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358898%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%20connected%20but%20no%20logs.%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358898%22%20slang%3D%22en-US%22%3EAfter%205%20hours%20data%20finally%20seems%20to%20be%20arriving%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

My office 365 says its connected, but no longs are coming into Sentinel..

 

 

9 Replies
Highlighted
After 5 hours data finally seems to be arriving
Highlighted

Behavior from my testing so far:

  • O365 says "Configure" instead of "connected," but I seem to get data.
    • Maybe it needs to catch up to a certain level before it changes status. Connected for 6ish hours so far. -
  • Azure AD Identity Protection got to status Connected in seconds
  • Azure Active Directory have been "connecting" from at least 5 hours now
    • Cant see any data from it yet. I'll just leave it until tomorrow and see if anything changes.
Highlighted

Thomas, 

 

Thanks for telling us about your experience. I'm adding @Koby Koren and @Shalini Pasupneti so they can note the issue and your feedback. 

Highlighted

Kjetil, 

 

Thanks for the detailed feedback. We'll look into these issues (CC: @Koby Koren and @Shalini Pasupneti). 

Highlighted

Thank you. I once in a while get this error while trying:

 

Experiencing authentication issues
The portal is having issues getting an authentication token. The experience rendered may be degraded. Additional information from the call to get a token: Extension: appinsightsextension Resource: loganalyticsapi Details: code: 0, statusText: error, message: ajaxExtended call failed, stack:
 
---
Data from O365 works very well while Azure AD just refuse to connect.
Highlighted

Same issue here,  I will give a day and check on it tomorrow. 

Highlighted

My O365 data has populated overnight / within 24hrs. 

Highlighted
Highlighted

Connected Office 365 activity log connector over 48h ago, still no data.

This is true for our tenant only (Pay-as-you-go).  For two other tenants (CSP Subscriptions) it seems to work.

 

I'm available for troubleshooting if any Microsoft peeps are interested. PM me or email me.