Hi,
I am having some issues with UEBA. I can enable this successfully and select my data sources however, the Identity Info tables are not being created. I do have all the required permissions to give consent for the sync to take place.
Does the sync with Azure AD run on a specific schedule?
Can this be enabled on multiple workspaces within the same Directory/Tenant?
Are there any additional permissions required to sync from AAD?
This is quite critical as we are looking to enhance much of our hunting and analytic queries by using data from the Identity Info table in order to provide valuable insights based on AAD Attributes such as location, office location etc.
