Office 365 connected but no logs.

Occasional Contributor

My office 365 says its connected, but no longs are coming into Sentinel..

 

 

9 Replies
After 5 hours data finally seems to be arriving

Behavior from my testing so far:

  • O365 says "Configure" instead of "connected," but I seem to get data.
    • Maybe it needs to catch up to a certain level before it changes status. Connected for 6ish hours so far. -
  • Azure AD Identity Protection got to status Connected in seconds
  • Azure Active Directory have been "connecting" from at least 5 hours now
    • Cant see any data from it yet. I'll just leave it until tomorrow and see if anything changes.

Thomas, 

 

Thanks for telling us about your experience. I'm adding @Koby Koren and @Shalini Pasupneti so they can note the issue and your feedback. 

Kjetil, 

 

Thanks for the detailed feedback. We'll look into these issues (CC: @Koby Koren and @Shalini Pasupneti). 

Thank you. I once in a while get this error while trying:

 

Experiencing authentication issues
The portal is having issues getting an authentication token. The experience rendered may be degraded. Additional information from the call to get a token: Extension: appinsightsextension Resource: loganalyticsapi Details: code: 0, statusText: error, message: ajaxExtended call failed, stack:
 
---
Data from O365 works very well while Azure AD just refuse to connect.

Same issue here,  I will give a day and check on it tomorrow. 

My O365 data has populated overnight / within 24hrs. 

Connected Office 365 activity log connector over 48h ago, still no data.

This is true for our tenant only (Pay-as-you-go).  For two other tenants (CSP Subscriptions) it seems to work.

 

I'm available for troubleshooting if any Microsoft peeps are interested. PM me or email me.