Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Watchlist Bulk Update - Failed to Read File (But does!)

Brass Contributor


I've been updating watchlists with no issues for ages.  Since yesterday, after selecting the file (which is a basic CSV file), the 50 rows preview is presented, a green ticket is shown next to the file, however the errir "Failed to Read file" is displayed.  You can progress to the next stage in the wizard, but no further as there is an issue with Source, therefore the validate button does not enable.

I have attached a screen shot.  Attempts to troubleshoot this have covered:

Try a copy of the CSV file;

Create a new CSV file with the same data;

Create a new CSV file with new data;

Use a previously known good file;

Try the above on a different watchlist.


However, creating a new watchlist and selecting the same file works!

Is there a maximum number of entries on a Watchlist?



6 Replies
Interestingly, I've exported the 4.9K watchlist entries, added the 300 Additional lines I was trying to append, gone through the "new watchlist" wizard and the file is accepted. I'm wandering if something changed that only affects older Watchlists....
I am facing the same issue today. Cannot update the older watchlist but able to create a new one with the same file. If anyone is aware of any changes that might be causing this, please share.
I'm encountering this too. I was working on a watchlist yesterday and discovered I didn't have all the data. So when I went to fix it today and update the watchlist, I'm also seeing "Failed to read file." when I choose the CSV to upload.

I can also create a new watchlist with the same CSV. But it won't let me update the existing one with any CSV file, including the CSV I originally used to populate it with yesterday.
I had the same problem. I was also able to upload a *.csv file, but I couldn't complete the wizard. Here's how I solved the problem. I edited the *.csv file again and arranged the columns so that the column with the most entries is displayed first (column A) and then the other columns are ordered in descending order so that the column with the fewest entries is displayed last.
Give it a try, maybe it will help you.
Thanks for the input. However in my watchlist every row has all columns populated, therefore all are equal - glad it worked for you though. I don't have the time for MS to acknowledge\fix so I had to export the original watchlist, append the data, create a new watchlist and adjust the pointers in the relevant analytical rule. For me, these have to stay up to date so unfortunately have to move on with the workaround (Which I'm not a fan of & would much prefer an actual resolution\answer) :)
@CodnChips Have you tried to update again recently? It started working again for me later on the 15th and I haven't seen the problem since. I assumed they fixed whatever the glitch was.