Azure Sentinel Office 365 Data Connectors

[Francesco47]

Hello Community!

I have a problem with Office 365 Data Connector in Azure Sentinel.

The source status is connected and I have a Security Administrator Role in my Tenant.

I tried to add another tenant ID in the configuration panel, but now I can't add it anymore and the button "Save" is disappeared. 

1) Do you know how could I solve this problem?

2) Is there a method to disconnect and reconnect this Office 365 connector?

Any help from you will be highly appreciated!

Thank you!

[#2]

@Francesco47 The ability to add multiple tenants was deprecated this month in lieu of upcoming features that align better with customer data privacy and security.

From the connector page (https://docs.microsoft.com/en-us/azure/sentinel/connect-office-365😞

If you already connected multiple tenants in a previously supported version of the Office 365 connector in Azure Sentinel, you will be able to view and modify which logs you collect from each tenant. You will not be able to add additional tenants, but you can remove previously added tenants.

[#3]

@Rod_Trent Thank you for your prompt reply.

I would like to restore my old tenant but I can not do that even if I don't have any tenant connected now.

It seems that there is no possibility to disconnect a single source connector. 

Can you confirm this or help us in order to find a solution?

Thank you for your support!

[#4]

@rodtrent I have the same problem as @Francesco47.

I canceled the single tenant that I had configured when I added the Office 365 Connector in Azure Sentinel, but now I do not have the possibility to add a single Azure tenant in the Office 365 connector configuration dashboard. In particular, the "plus" (+) button disappeared.

Is there a way to reconfigure a single Azure tenant in Office 365 Connector of Azure Sentinel.

Thank you in advance!

[#5]

@Francesco47 Just to get a clearer understanding...

Would you say you deleted Azure Sentinel before disconnecting the Office 365 Data Connector and it seems to now assume its still connected?

[#6]

@Rod_Trent 

I did not delete Azure Sentinel. I only deleted the Tenant in the Office 365 Data Connector configuration page. 

See the screenshot attatched.

As you can see there is not any Tenant configured.

[#7]

@Francesco47 OK...so there's some interesting data on that screen. Did you notice that its still connected and receiving data? Last data received was 49 minutes ago.

[#8]

@Rod_Trent Do you know what these privacy and security concerns were and why it wasn't left up to the customer to decide upon the same.