SOLVED

Unable to add Office 365 as data source

%3CLINGO-SUB%20id%3D%22lingo-sub-1287471%22%20slang%3D%22en-US%22%3EUnable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1287471%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EDear%20All%2C%20We%20have%20been%20trying%20to%20enable%20Azure%20sentinel%20for%20our%20tenant%20and%20for%20our%20customers.%20While%20we%20are%20able%20to%20add%20data%20connector%20with%20Azure%20AD%20and%20on%20premises%20workloads%20to%20the%20sentinel%2C%20we%20were%20unable%20to%20add%20Office%20365%20(exchange%20online%20%26amp%3B%20SharePoint%20online)%20to%20the%20sentinel.%20It%20throws%20an%20error%20%22Unauthorized%20to%20apply%20changes%20%2C%20License%20is%20invalid%22%20.%20We%20have%20followed%20MS%20article%20and%20we%20have%20a%20mix%20of%20Office%20365%20E3%2C%20E1%20and%20business%20essentials%20(total%20license%20close%20to%20250).%20We%20also%20verified%20if%20the%20unified%20audit%20log%20ingestion%20is%20enabled%2C%20which%20is%20also%20true.%20Attached%20is%20the%20error%20snap%2C%20any%20help%20would%20be%20highly%20appreciated.%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1288102%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1288102%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F362038%22%20target%3D%22_blank%22%3E%40Shijuc%3C%2FA%3E%26nbsp%3BI've%20seen%20this%20before.%20In%20some%20cases%20it%20resolved%20itself%20after%20a%20period%20of%20time%2C%20but%20in%20most%20of%20those%20cases%20required%20opening%20a%20support%20ticket.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1288795%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1288795%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3BFollow-up.%20This%20is%20being%20looked%20into.%20Stay%20tuned.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1290370%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1290370%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F362038%22%20target%3D%22_blank%22%3E%40Shijuc%3C%2FA%3E%26nbsp%3BSame%20problem%20here%2C%20note%20the%20misspelled%20%22Unautherized%20to%20apply%20changes%22%20message.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22AdiGrio_0-1586308177351.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F182966iF27D8B7C4B6A072D%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22AdiGrio_0-1586308177351.png%22%20alt%3D%22AdiGrio_0-1586308177351.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3EIt%20was%20ok%20before%2C%20we%20just%20moved%20to%20a%20new%20subscription%20and%20recreated%20the%20Sentinel%20configuration.%20Trying%20to%20add%20O365%20to%20the%20old%20Sentinel%20results%20in%20the%20same%20problem.%20Of%20course%20the%20license%20is%20valid.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1290581%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1290581%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3B%20Thanks%20for%20your%20response%2C%20is%20this%20an%20issue%20product%20team%20looking%20into%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1291477%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1291477%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F362038%22%20target%3D%22_blank%22%3E%40Shijuc%3C%2FA%3E%26nbsp%3BYes.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1291597%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1291597%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3BThis%20should%20now%20be%20resolved.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1292369%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1292369%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3BYes%2C%20it%20works%20now.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1294956%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1294956%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F353788%22%20target%3D%22_blank%22%3E%40AdiGrio%3C%2FA%3E%26amp%3B%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F324945%22%20target%3D%22_blank%22%3E%40rodtrent%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20information.%20But%2C%20It%20does%20not%20work%20for%20us%20still%20and%20giving%20the%20same%20error.%20Our%20licenses%20are%2025%20M365%20E3%20and%20rest%20are%20E1%20or%20business%20essentials%20(approx.%20300).%20Anything%20to%20do%20with%20that%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1304599%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20add%20Office%20365%20as%20data%20source%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1304599%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F353788%22%20target%3D%22_blank%22%3E%40AdiGrio%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThis%20works%20for%20us%20too%20now.%20Coincidentally%20there%20was%20a%20GA%20permission%20revoke%20in%20the%20back%20end%20recently.%20GA%20permission%20is%20now%20reinstated.%26nbsp%3B%20This%20time%20it%20was%20because%20of%20permission.%26nbsp%3B%20Thank%20you%20all%20for%20the%20support.%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

Dear All, We have been trying to enable Azure sentinel for our tenant and for our customers. While we are able to add data connector with Azure AD and on premises workloads to the sentinel, we were unable to add Office 365 (exchange online & SharePoint online) to the sentinel. It throws an error "Unauthorized to apply changes , License is invalid" . We have followed MS article and we have a mix of Office 365 E3, E1 and business essentials (total license close to 250). We also verified if the unified audit log ingestion is enabled, which is also true. Attached is the error snap, any help would be highly appreciated.

9 Replies

@Shijuc I've seen this before. In some cases it resolved itself after a period of time, but in most of those cases required opening a support ticket.

@rodtrent Follow-up. This is being looked into. Stay tuned.

@Shijuc Same problem here, note the misspelled "Unautherized to apply changes" message.

 

AdiGrio_0-1586308177351.png

It was ok before, we just moved to a new subscription and recreated the Sentinel configuration. Trying to add O365 to the old Sentinel results in the same problem. Of course the license is valid.

@rodtrent  Thanks for your response, is this an issue product team looking into?

Best Response confirmed by Shijuc (New Contributor)
Solution

@rodtrent This should now be resolved.

@rodtrent Yes, it works now.

@AdiGrio@rodtrent 

Thanks for the information. But, It does not work for us still and giving the same error. Our licenses are 25 M365 E3 and rest are E1 or business essentials (approx. 300). Anything to do with that?

@AdiGrio 

This works for us too now. Coincidentally there was a GA permission revoke in the back end recently. GA permission is now reinstated.  This time it was because of permission.  Thank you all for the support.