1,476 questions

Sort by: Updated
Updated Created Answers
1 answer

Microsoft Threat Intelligence IOC - Cloudflare IPs Triggering Sentinel Noise

We have recently observed multiple Microsoft Sentinel incidents being triggered by IP addresses associated with Cloudflare that are currently being flagged by Microsoft Threat Intelligence IOC feeds. Our investigation indicates these IPs belong to…

Microsoft Security | Microsoft Sentinel
asked 2026-11-05T22:50:11.3066667+00:00
JC 40 Reputation points
answered 2026-11-05T22:55:56.2666667+00:00
JC 40 Reputation points
0 answers

Microsoft Sentinel auto-resolving to "Simple mode" rather than "KQL mode".

Regardless of the setting being enabled to "Select the mode you would like Log Analytics to be in default" - see attached image - sentinel has recently been automatically opening Log Analytics in simple mode. Whilst this obviously isn't a huge…

Microsoft Security | Microsoft Sentinel
asked 2026-11-04T05:29:44.0066667+00:00
Arthur Williams 0 Reputation points
2 answers

Title: Microsoft Sentinel – Logic Apps Playbook Permissions Update Fails: Service Principal Not Found

Hello Microsoft Support Team / Community, I am experiencing an issue with Microsoft Sentinel Logic App playbook permissions in the Microsoft Defender portal. Environment: Microsoft Sentinel integrated with Microsoft Defender XDR Sentinel workspace:…

Microsoft Security | Microsoft Sentinel
asked 2026-10-19T12:21:52.1933333+00:00
Trilok Patel 0 Reputation points
answered 2026-11-03T15:56:03.4+00:00
DavideDG_P 0 Reputation points
1 answer

Understand query property propagation in sentinel playbook

Hi Team, I'm trying to understand the source of the Query property that is being used in a Sentinel playbook and whether it's associated specifically with analytics rule-generated alerts. Scenario: I have a Sentinel playbook (Logic App) that contains a…

Microsoft Security | Microsoft Sentinel
asked 2026-11-03T11:18:29.2433333+00:00
cyber punk 40 Reputation points
answered 2026-11-03T11:19:44.56+00:00

AI answer

0 answers

Window Def data lake function missingwith Microsoft 365 E7 license ,

Window Def portal data lake function missing for window defender sentinels we using Microsoft 365 E7 license ,

Microsoft Security | Microsoft Sentinel
asked 2026-10-31T02:30:16.79+00:00
Sean Ong 0 Reputation points
1 answer

Microsoft entra ID protection alert ingestion into sentinel

Hello community, I recently enabled sentinel on a log analytics workspace. The defender connectors were installed automatically. I believe this is because now sentinel onboarded into defender. After a day, I noticed that microsoft entra ID protection…

Microsoft Security | Microsoft Sentinel
asked 2026-10-30T09:06:02.4566667+00:00
cyber punk 40 Reputation points
answered 2026-10-30T09:07:20.4533333+00:00

AI answer

1 answer One of the answers was accepted by the question author.

Question about Sentinel end of support

I got a notice from Microsoft about the end of support for Sentinel in the Azure portal on March 31, 2027. I only have one Sentinel instance in Azure at the moment and have already connected it to the defender portal per the documentation attached to the…

Microsoft Security | Microsoft Sentinel
asked 2026-10-29T18:16:56.9433333+00:00
Luikart, Christopher 20 Reputation points
accepted 2026-10-29T18:22:47.5133333+00:00
Luikart, Christopher 20 Reputation points
1 answer

Issues trying to connect to MITRE ATT&CK STIX 2.1 Feed from Sentinel Threat Intelligence

Hi, I am having issues while trying to connect to the MITRE ATT&CK STIX 2.1 Feed from within Sentinel's Threat Intelligence module. I have the 'Threat Intelligence - TAXII' data connector enabled (with another TAXII server…

Microsoft Security | Microsoft Sentinel
asked 2025-02-03T04:58:21.01+00:00
WillAngus-6254 5 Reputation points
commented 2026-10-29T17:11:57.25+00:00
Andrew Owen 0 Reputation points
1 answer

Technical Guidance Required – Microsoft Sentinel Integration with Dynamics 365 via Logic Apps / Dataverse

We are evaluating an integration between Microsoft Sentinel and Microsoft Dynamics 365 for centralized incident/ticket management. Our intended high-level flow is: Microsoft Sentinel Incident → Automation Rule → Sentinel Playbook / Azure Logic App →…

Microsoft Security | Microsoft Sentinel
asked 2026-10-29T10:11:19.91+00:00
Sayali Raghunath Kanade 0 Reputation points
answered 2026-10-29T10:12:32.78+00:00

AI answer

1 answer

Agentless SAP connector ingests only few users into ABAPUserDetails

Good Day! we are using the Microsoft Sentinel solution for SAP applications with the agentless data connector (SAP Integration Suite), for the SAP PCE Test System to ingest the logs in MS Sentinel the Data connector includes 4 Data type …

Microsoft Security | Microsoft Sentinel
asked 2026-10-27T10:14:56.8666667+00:00
Qais Naderi 0 Reputation points
answered 2026-10-27T10:15:45.83+00:00

AI answer

1 answer

Account got hacked

Hello everyone, My other microsoft account got hacked and I tried everything but I really cant get it back, I tried to submit 3 appeals already and no answer, I really need that account back, I spent so much money on it and it makes me sad that even if I…

Microsoft Security | Microsoft Sentinel
asked 2026-10-25T15:44:33.6366667+00:00
Mendi Roland 0 Reputation points
answered 2026-10-25T15:45:35.0433333+00:00

AI answer

2 answers

How to stream Azure Activity logs into log analytic Workspace

Hello Microsoft Community, I am migrating Microsoft Sentinel from a source Azure tenant to a target Azure tenant and need clarification regarding the Azure Activity data connector. In the source tenant, the Azure Activity connector is connected and…

Microsoft Security | Microsoft Sentinel
asked 2026-10-16T23:46:34.91+00:00
cyber punk 40 Reputation points
answered 2026-10-18T22:40:04.3+00:00
Rauh, Alexander 330 Reputation points
2 answers

Governance relationships can't co-exist with pre-configured GDAP admin relationship

I operate for an MSSP, we are CSP as well. Below is our setup - We have GDAP setup for our clients to support their 365 services. We have Azure lighthouse to centrally manage their subscriptions. Microsoft announced last year that Sentinel is going…

Microsoft Security | Microsoft Sentinel
asked 2026-08-13T09:19:57.15+00:00
Khanna, Keshav 20 Reputation points
commented 2026-10-16T07:18:21.0666667+00:00
DavideDG_P 0 Reputation points
2 answers

Suspicious IP address outbound to our Team workload

I get a suspicious IP address on my Teams workloads when I run a KQL query in Sentinel. No one in ICT knows the IP address. How can I investigate this issue further? In the interim, we have blocked the IP address on the Firewall.

Microsoft Security | Microsoft Sentinel
asked 2026-10-13T09:38:18.33+00:00
Admin-Patrick 0 Reputation points
answered 2026-10-13T21:28:30.6866667+00:00
Rauh, Alexander 330 Reputation points
1 answer

Log entry with unexplainable IP address in OfficeActivity

Hi. Our OfficeActivity table shows an event occurred from an IP address that's part of Microsoft's block, but in a sub-subnet that has supposedly been reassigned to an ISP in Miami. We don't have anyone working from the US, so it raised some alarms. The…

Microsoft Security | Microsoft Sentinel
asked 2026-10-08T06:45:31.2133333+00:00
MrBee 0 Reputation points
commented 2026-10-09T19:59:41.07+00:00
Rauh, Alexander 330 Reputation points
1 answer

Azure Sentinel Query Pane Not Taking input/broken

All of our Sentinel Workspaces Logs Query Panes in our Lighthouse instances have now become non-editable, to the point where the query box will not take cursor input or any keyboard input from the users. Using our GDAP technician accounts also doesn't…

Microsoft Security | Microsoft Sentinel
asked 2026-06-24T04:21:11.33+00:00
Kellen Connolly 0 Reputation points
answered 2026-10-06T10:11:09.2966667+00:00
Konstantinos Lianos 835 Reputation points Student Ambassador
1 answer

The tenant is not approved for MicrosoftTi connector onboarding

We are trying to register the Microsoft Threat Intelligence connector in our Sentinel Workspace, but are seeing this error: The tenant is not approved for MicrosoftTi connector onboarding. Complete CFAR registration and retry. The error also contains a…

Microsoft Security | Microsoft Sentinel
asked 2026-09-21T15:47:11.3333333+00:00
Mark Pavlitski 0 Reputation points
answered 2026-10-06T10:08:58.82+00:00
Konstantinos Lianos 835 Reputation points Student Ambassador
1 answer

Microsoft Sentinel: Incident Link Not Opening Referenced Incident — Troubleshooting Assistance Needed

Problem description I am experiencing an issue where the links in incident notification emails from Microsoft Sentinel and Microsoft 365 Defender do not open the referenced incident as expected. Instead, clicking the link opens the incident list or only…

Microsoft Security | Microsoft Sentinel
asked 2026-10-01T13:40:30.4166667+00:00
JonathanSkitt-1100 0 Reputation points
answered 2026-10-05T23:30:22.3566667+00:00
Anton W 6 Reputation points
1 answer

Microsoft Sentinel Stuck in a Loop in the Defender Portal

In the microsoft defender portal with sentinel, i have connected, disconnected and waited 30 minutes, and reconnected the SIEM workspace. if i go to sentinel and any of the tabs in defender, it just loops to the connectors page as if the workspace is not…

Microsoft Security | Microsoft Sentinel
asked 2026-05-12T03:48:26.8633333+00:00
Malaurm 0 Reputation points
commented 2026-09-30T10:03:59.24+00:00
Antony Freer 0 Reputation points
1 answer

Cisco Firepower Integration (FTD)with Microsoft Sentinel

Dear Microsoft Support, I am currently working to integrate Microsoft Sentinel with Cisco Firepower using the recommended Cisco Firepower eStreamer data connector. As part of the setup, Microsoft’s documentation references the use of the Cisco eStreamer…

Microsoft Security | Microsoft Sentinel
asked 2025-10-24T18:26:31.7833333+00:00
Aksoy, Mehmet 30 Reputation points
commented 2026-09-24T13:01:56.9733333+00:00
Augusto Aniceto 0 Reputation points