Azure activity connector no longer data receiving

Hi Zeeshan Siddiqui

1)Please try the below Kql query, it will get the last one-hour activity log

AzureActivity
| where TimeGenerated > ago(1h)
| sort by TimeGenerated desc

2)Refresh Data Connector Configuration

In Microsoft Sentinel:

Go to Data Connectors > Azure Activity > Open Connector Page.

Unlink and re-link the subscription.

Make sure it's showing "Connected" and there are no error messages.

Let us know if you have any concerns. We are happy to assist you.

If the comment was helpful, please click "Upvote"

The option to unlink and re-link the subscription is not available in my case. Please suggest how to disconnect old legacy method for azure activity connector from the existing azure subscriptions.

Now I did the following:

1. I exported the subscription activity logs in a new diagnostic setting and set send to the newly created Log Analytics Workspace.
2. Deleted the old relevant Azure activity data connector policy.
3. Deleted the Azure activity data connector in Sentinel.
4. Reinstall the Azure activity connector from the content hub.
5. Launched Azure policy assignment wizard. Selected the subscription in scope where a new Log Analytics workspace was created. In the parameter tab said new log analytics workspace is selected. A new remediation task with a new system-assigned management identity is created.
6. The above policy assignment wizard created a new policy for the log stream to the log analytics workspace, which is compliant.
7. I checked that logs are generated in the said new log analytics workspace.

Still, the Azure Activity Data connector is disconnected, and no logs are ingested.

Please suggest what is not working or misconfigured.

Hi Zeeshan Siddiqui,

It looks like you've carefully rebuilt the setup. Since logs are successfully flowing into the Log Analytics workspace, but the Azure Activity connector in Sentinel still shows as “Disconnected”, the issue is likely related to how the Sentinel data connector is linked to the workspace and subscription log stream.

In Microsoft Sentinel → Settings → Workspace Settings → Data Sources → Azure Activity, make sure the subscription is listed under “Connected Subscriptions”. If not, it means Sentinel hasn’t associated that subscription with this workspace’s activity logs.

Once, try checking diagnostic setting for Activity Logs

az monitor diagnostic-settings subscription show --name "<diag-setting-name>" --subscription "<your-subscription-id>"

Sometimes even the data flows connector status might show “Disconnected” for a while** due to internal sync delays so try running the logs

AzureActivity

| where TimeGenerated > ago(1h)

| take 10

Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hi Zeeshan Siddiqui,

We haven’t heard from you on the last response, and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, please respond with more details and we will try to help.