How to connect Azure Activity data connector in Sentinel

Ty 20 Reputation points
2025-01-10T20:39:41.94+00:00

Hello,

I am having trouble connecting the Data Connectors in Sentinel. The instructions in Microsoft Learn differ from what I observe in Sentinel, but here is what I have done thus far: I have installed the Azure Activity Data Connector from the Content Hub. Next, I opened the connector page and click ed "Launch Azure Policy Assignment wizard>". For the scope, I have selected mySubscription. In the Parameters tab, I selected myLogAnalyticsWorkspace, which is the Log Analytics workspace that I have deployed Sentinel to. In the remediation tab, I check the "Create a remediation task" check box, then I created the policy. I have confirmed in the Policy service that this policy was deployed, but in Sentinel the Azure Activity Data Connector still shows as disconnected, and no data is moving through the connector. What am I missing here?

Microsoft Security | Microsoft Sentinel
0 comments
Answer accepted by question author
Givary-MSFT 35,916 Reputation points Microsoft Employee Moderator
2025-01-13T09:49:33.23+00:00

@Ty Thank you for reaching out to us, came across this video - https://www.youtube.com/watch?v=gWK6n6Frg1o where detailed steps mentioned on how to connect Azure Activity data connector in Sentinel.

I have followed the same steps in my subscription, after 15 to 30 mins, data started ingesting in Sentinel.

If this doesn't help, let me know we can connect offline to review further on this.

Was this answer helpful?

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.