Microsoft Sentinel Stuck in a Loop in the Defender Portal

Question

Microsoft Sentinel Stuck in a Loop in the Defender Portal

Malaurm 0

In the microsoft defender portal with sentinel, i have connected, disconnected and waited 30 minutes, and reconnected the SIEM workspace. if i go to sentinel and any of the tabs in defender, it just loops to the connectors page as if the workspace is not at all connected. this is stopping me from being able to do certain actions like get content from the content hub, manage incidents, hunting, etc because Sentinel the defender portal is stuck in this infinite loop. In the image below is just showing it is from the defender portal. i can click on any tab under sentinel and it takes me to this page

User's image

I also have confirmed the XDR connector is connected

User's image

Any help would be much appreciated

Malaurm 0 Reputation points

2026-05-12T03:51:51.8266667+00:00

To add, I also am accessing this from a global admin account
Shubham Sharma 15,005 Reputation points Microsoft External Staff Moderator

2026-05-12T04:50:10.31+00:00
Hey Malaurm, it looks like Defender knows you’ve connected the workspace (you can see it under Settings > Microsoft Sentinel > SIEM workspaces), but when you click any of the other Sentinel blades (Search, Threat management, Content management, etc.), nothing loads and you end up back on the connectors page. That usually means Sentinel itself hasn’t been fully onboarded on the Log Analytics workspace or the Defender portal UI is filtering out your workspace. Here’s what to try:

Make sure Microsoft Sentinel is actually enabled on that workspace in the Azure portal • Go to portal.azure.com > Microsoft Sentinel • Click “+ Add” and select your Log Analytics workspace • Wait a few minutes for deployment, then refresh

Clear or adjust the subscription filters in the Defender portal • In the Defender portal, open any Sentinel tab and look at the filter bar (it shows “Subscription: …”) • Remove all filters so you see all workspaces, then re-select your subscription

Check your permissions • You’re a Global Admin, but double-check that you also have the Security Admin or Sentinel Contributor role on the workspace’s subscription and resource group

Flush local browser state • Log out of Defender/Portal, clear cookies/cache or try an incognito session • Try a different browser to rule out caching or extension conflicts

Hope that helps!

Reference List

Onboarding a Microsoft Sentinel workspace into the Defender portal https://learn.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration?tabs=defender-portal

Transition your Microsoft Sentinel environment to the Defender portal https://learn.microsoft.com/azure/sentinel/move-to-defender

Quickstart: Onboard Microsoft Sentinel https://docs.microsoft.com/azure/sentinel/quickstart-onboard

Microsoft Sentinel in the Microsoft Defender portal https://learn.microsoft.com/azure/sentinel/microsoft-sentinel-defender-portal?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider

Azure built-in roles for RBAC (e.g. Sentinel Contributor, Security Admin) https://docs.microsoft.com/azure/role-based-access-control/built-in-roles
Malaurm 0 Reputation points

2026-05-12T20:58:26.6066667+00:00
Hello,

the most important thing is sentinel was previously working just fine and in the last week it just broke to this state. i had not made any changes. my tenant is licensed for e5.

i have confirmed that it is added in sentinel. i can go to sentinel in azure and make queries and do limited work in it. i can make queries but every time i go to the content hub it tells me to go to the defender portal which obviously does not work

I only have 1 sentinel instance and it is onboarded to the workspace properly

all subscriptons are cleared and my sentinel instance is confirmed the only one,

i am the owner of the subscription on down.

i have tried a different browser and incognito mode and it does not work

1 answer

Your answer

Malaurm 0 Reputation points

2026-05-12T03:51:51.8266667+00:00

To add, I also am accessing this from a global admin account
Malaurm 0 Reputation points

2026-05-12T20:58:26.6066667+00:00

Hello,

the most important thing is sentinel was previously working just fine and in the last week it just broke to this state. i had not made any changes. my tenant is licensed for e5.

i have confirmed that it is added in sentinel. i can go to sentinel in azure and make queries and do limited work in it. i can make queries but every time i go to the content hub it tells me to go to the defender portal which obviously does not work

I only have 1 sentinel instance and it is onboarded to the workspace properly

all subscriptons are cleared and my sentinel instance is confirmed the only one,

i am the owner of the subscription on down.

i have tried a different browser and incognito mode and it does not work

Answer 1

The behavior described usually occurs when the Defender portal does not have a valid primary Microsoft Sentinel workspace context, or when the signed‑in account does not meet the Sentinel permissions required in the Defender portal.

Use the following checks and fixes in the Defender portal (https://security.microsoft.com):

Confirm the primary workspace
1. Go to System > Settings > Microsoft Sentinel > Workspaces.
2. Verify that the intended workspace is listed as Connected and marked Primary.
3. If it is not primary, select the workspace and choose Set as primary, then confirm the change.
4. Wait a few minutes and then try opening Microsoft Sentinel > Threat management (for example Workbooks, Hunting, or MITRE ATT&CK).
Verify required roles and scope Ensure the account has at least the following on the Sentinel workspace (or its resource group/subscription):
- Microsoft Sentinel Reader to view Sentinel in the Defender portal and query data tables or view incidents.
- Microsoft Sentinel Contributor to take investigative actions on incidents or manage content. Also make sure the account has the necessary Azure RBAC scope (subscription, resource group, or workspace) where Sentinel is enabled. If there is more than one Sentinel workspace in the tenant, the account must also be at least Security administrator in Microsoft Entra ID.
Reconnect or switch workspaces if needed
- If the workspace was disconnected and reconnected multiple times, from System > Settings > Microsoft Sentinel > Workspaces, select the workspace and choose Disconnect workspace, confirm, then connect it again.
- If there is another Sentinel workspace, try temporarily setting that one as primary, confirm that Sentinel opens, and then switch back to the desired workspace as primary. When switching the primary workspace, the Defender XDR connector is automatically moved to the new primary and disconnected from the former one.
Validate data connector behavior
- In the Azure portal, confirm the Microsoft Defender XDR connector is connected and that incidents and alerts are enabled for the Sentinel workspace.
- Be aware that after onboarding to Defender, the Defender product connectors (Defender for Endpoint, Identity, Cloud Apps, Office 365) no longer appear in the Defender portal Data connectors page; this is expected and does not indicate a connection issue.

If, after confirming the primary workspace and permissions, the Defender portal still loops back to the connectors page for all Sentinel blades, collect a portal session recording and open a support request from the affected subscription so that Microsoft can review the tenant’s Sentinel–Defender integration state.

References:

Share via

Microsoft Sentinel Stuck in a Loop in the Defender Portal

1 answer

Your answer