How to connect Azure Activity data connector in Sentinel

Question

How to connect Azure Activity data connector in Sentinel

Ty 20

Hello,

I am having trouble connecting the Data Connectors in Sentinel. The instructions in Microsoft Learn differ from what I observe in Sentinel, but here is what I have done thus far: I have installed the Azure Activity Data Connector from the Content Hub. Next, I opened the connector page and click ed "Launch Azure Policy Assignment wizard>". For the scope, I have selected mySubscription. In the Parameters tab, I selected myLogAnalyticsWorkspace, which is the Log Analytics workspace that I have deployed Sentinel to. In the remediation tab, I check the "Create a remediation task" check box, then I created the policy. I have confirmed in the Policy service that this policy was deployed, but in Sentinel the Azure Activity Data Connector still shows as disconnected, and no data is moving through the connector. What am I missing here?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Givary-MSFT 35,916 Microsoft Employee Moderator

@Ty Thank you for reaching out to us, came across this video - https://www.youtube.com/watch?v=gWK6n6Frg1o where detailed steps mentioned on how to connect Azure Activity data connector in Sentinel.

I have followed the same steps in my subscription, after 15 to 30 mins, data started ingesting in Sentinel.

If this doesn't help, let me know we can connect offline to review further on this.

Ty 20 Reputation points

2025-01-20T02:48:02.29+00:00

Thank you @Givary-MSFT . It turns out the changes were just taking longer than I had expected to propagate. I reviewed the video and have accepted the answer because the instructions seem to be accurate!
Jennifer Bader 0 Reputation points

2025-05-12T20:00:40.0866667+00:00

I've gone through the steps multiple times but I'm getting stuck where my connection is still Disconnected. The 'Policy' and 'Subscription' prerequisites are not green checked, and I cannot determine why that's the case. I am owner on everything. Let me know what I should check for.