Azure Activity Data Connector

[Smittydude8822]

Hi All,

My organization is currently working to stand up Sentinel and we are implementing our data connectors. However, we are unable to enable the Azure Activity data connector. All policies are written correctly and should be sending to Sentinel, but it is saying not connected. 

Any recommendations?

[#2]

@Smittydude8822 

How long have you waited so far, it can sometimes take an hour or more?

Have you actually checked to see if data is being sent - I've seen cases where its shown as "not connected" but you do get data?

[#3]

We've attempted to do this a few times over the past few weeks with no success. We've put the policy in place and waited over the period of time that has been suggested, but still no connection.

[#4]

Did you do the remediation task ok? There is a step by step walkthrough here:

https://intothecloudverse.com/2021/08/24/azure-activity-data-connector-for-azure-sentinel-issue-and-...

[#5]

It's really strange. I found that document as well. After a few minutes, it does register that the policy is compliant, but does not appear that it has connected.

[#6]

@Smittydude8822 

You can manually export the Activity Log to Log Analytics. This is what the remediate task does.

https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell#send-t... 

[#7]

@Smittydude8822 

Check if your policy scope is the resource group instead of the subscription. I made that mistake the first time deploying the connector in a similar situation than the one described.

For it to work, the scope must be the susbscription.

Hope this helps.

[#8]

Hi All,

I am looking to get away from the legacy method and connect via the new method. Does anyone know what permissions are needed for the policy to take affect? I have written the policy, but the logs are not being sent over and ingested by Sentinel.

[#9]

@tungdra I've noticed that during deployment Azure have created Remediation task for Azure Activity connector along with service principal and rights in log analytics + subscription right in IAM.

Do you think it can be removed? Or data ingestion will stop after removal?