May 29 2020 08:03 AM
We recently migrated regions in Azure and reconfigured the logs to send to the new workspace. However, the AzureAD/Activity logs still say they're connected to the old workspace and no logs are being sent to the new workspace.
Everything is turned off and unchecked in the old Sentinel connector. The diagnostic setting in AzureAD is configured to the new Sentinel workpsace, and the connector is enabled and boxes are checked for the logs. The connector is still showing as disconnected though.
Jun 01 2020 01:52 AM
@leoszalkowski : To make sure I understand - you connected to the new workspace using the diagnostics settings for AAD rather than the Sentinel connector? If so, can you check if events are coming in even if the connector says "not connected"?
Jun 01 2020 06:30 AM
@Ofer_Shezaf Apologies. I meant to delete the post. The issue resolved itself. Took about 20ish minutes for everything to sync.