Sentinel workspace tables not appearing in Defender portal advanced hunting schema

Question

Sentinel workspace tables not appearing in Defender portal advanced hunting schema

ChungJeong Woo 20

Microsoft Sentinel workspace tables are not queryable in the Defender portal advanced hunting page. The Schema tab only shows six Defender XDR tables and no workspace table group appears.

Querying AzureActivity returns a semantic error saying it failed to resolve the table or column expression. The same happens for the Usage table.

The same query in the Azure portal under Microsoft Sentinel and Logs returns results normally, so ingestion and storage are working. The problem is limited to the Defender portal.

Environment is a single Entra tenant with one subscription on a free trial, no Defender XDR license, workspaces in Japan East with Sentinel enabled.

The account is a Global Administrator in Entra ID and Owner at subscription scope with an unconditional role assignment. Microsoft Sentinel Contributor is also assigned at the workspace resource.

This was reproduced on two separate workspaces. One was reconnected through the full onboarding wizard and the other was created fresh and automatically onboarded while the account already had Owner. Both show the same result after more than two days.

Is there an additional prerequisite for workspace tables to appear in the unified hunting schema, or a known limitation when Sentinel is onboarded without a Defender XDR license?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello @ChungJeong Woo

This does not appear to be a Defender XDR licensing limitation.

Microsoft Sentinel can be used in the Microsoft Defender portal without requiring a separate Defender XDR license. Once a Sentinel-enabled Log Analytics workspace is successfully connected to the Defender portal, supported Sentinel workspace tables should become available in Hunting > Advanced hunting.

Based on the configuration described, the permissions also appear sufficient. Having Microsoft Sentinel Contributor on the workspace, together with Owner permissions at subscription scope, should allow access to the Sentinel data.

AzureActivity is a supported Sentinel/Log Analytics table and should be queryable from Advanced Hunting after the workspace has been correctly onboarded. Therefore, an error such as:

Failed to resolve table or column expression named 'AzureActivity'

suggests that the Sentinel workspace schema has not been correctly exposed or synchronized with the Defender portal, rather than an ingestion issue.

I would verify the following:

Go to Microsoft Defender portal > System > Settings > Microsoft Sentinel > Workspaces and confirm that the workspace status is Connected.

Confirm that the correct workspace is selected/configured as the primary Sentinel workspace.

Confirm that the Defender portal is opened under the same Microsoft Entra tenant where the Sentinel workspace exists.

Test a simple query such as:

AzureActivity

| take 10

Test another Sentinel Analytics-tier table that is known to contain data, to confirm whether the issue affects the entire Sentinel schema or only specific tables.

Since the same behavior has already been reproduced with two separate workspaces, persists for more than 48 hours, and the same tables work correctly from Microsoft Sentinel / Log Analytics in the Azure portal, this looks more like a Defender portal onboarding/schema synchronization or backend provisioning issue.

If the workspace shows as successfully connected under Settings > Microsoft Sentinel > Workspaces, but no Sentinel workspace tables appear in the Advanced Hunting schema, I would recommend opening a Microsoft support case and providing the Tenant ID, Workspace ID, region, onboarding timestamp, and screenshots of both the workspace connection status and the Advanced Hunting schema.

If helps my answer please check it as resolver! :)