Azure Activity data collector with Azure Policy : data is not ingested

[PhilippeAugras]

Hi,

I have been fighting with the new Azure Activity data connector. I deploy the policy with the wizard the the connector page, scope it to my subscription but nothing happens. My Policy shows as Compliant, the Log Analytics workspace is in the scoped subscription but nothing happens. It's not the first time that I'm stuck with this problem and I think I've been applying MS' official documentation.

Any idea what I should check ?

Regards,

P.

[#2]

@PhilippeAugras Have you gone to the Activity log and checked the Diagnostics settings to verify that the settings were indeed pushed correctly?

[#3]

@Gary Bushey , thank you for your answer. The diagnostic settings worked with the old version of the connector. The new one relies on an Azure Policy that i supposed to send the activity to Sentinel's log. Or do I also need to configure the diag settings for this new connector ? It's not mentioned in MS's docs.

Regards,

P.

[#4]

You don't need to configure the diag settings if the policy is working correctly. My suggestion was just to check to make sure the policy did work correctly.

[#5]

Sorry for my misunderstanding. The policy show 100% Compliant, no errors. Problem - ? - is that the policy also tells me there's no ressource associated. I scoped it to the Subscription I want to monitor via Azure Activity connector - as per MS doc. But do I need to add my Sentinel Log Analytics workspace as a resource to this policy ?

[#6]

@PhilippeAugras  I think that it makes sense that there is no ressources associated, because the policy is applied to the subscription only and not specific resources.
So if you go to the subscription for which you applied the policy, then choose "Activity Logs" and then choose "Diagnostic Settings" in the top of the window, you should be able to see the diagnostic settings from the subscription is being sent to sentinel. 

It seems like you expect all resources in the subscription to have their diagnostic settings updated (please correct me if im wrong).  Only the chosen subscription's diagnostic settings will be set.

Bonus: if you want to have multiple subscriptions set, you need to create a management group, and assign the policy to a group containing multiple subscriptions.

[#7 · Accepted solution]

I finally found out what the problem was. I had forgotten to enable a remediation during the policy creation. ow it works.

[#8]

I was having issues with the Azure Activity connector not 'connecting' and it was due to the fact that I assigned the policy to the sub and the rg. I cretaed a new one assigned only to the subscription and after about 10 minutes it connected.