1,458 questions with Microsoft Security | Microsoft Sentinel tags

Sort by: Updated
Updated Created Answers
0 answers

Defender Unified RBAC also shows “Failed to load workspace data.”

I have a Microsoft Sentinel workspace connected to Defender XDR as Primary, but Advanced Hunting does not show any Sentinel workspace tables in Schema. workspace('<WorkspaceID>').<Table> is unavailable, while Azure Portal Sentinel/Log…

Microsoft Security | Microsoft Sentinel
asked 2026-09-10T15:18:51.77+00:00
Abdulrhman Abbad 0 Reputation points
3 answers

‎Unable to create automation rules for Sentinel

Hi experts, I have tried Defender Portal -> Sentinel -> Configuration -> Automation to create a new automation rule to assign new alerts to a user. But it failed with error "You don't have permission to perform this action." User:…

Microsoft Security | Microsoft Sentinel
asked 2026-09-02T23:35:59.6766667+00:00
CharlesRa 0 Reputation points
answered 2026-09-05T18:53:04.23+00:00
EduardsGrebezs 1,276 Reputation points
1 answer One of the answers was accepted by the question author.

Azure Workbook

Hi i have an issue i am enountering. I am tryingto have different ysplit panels in azure but i cant. I used he render qquery but it is like ignore when running. Here is my query let SHO_CPU = Perf | where Computer in (dynamic([{WVDHosts}])) | where…

Microsoft Security | Microsoft Sentinel
asked 2026-08-28T09:32:49.8266667+00:00
Tchakounte Tchakounte, Hillary 20 Reputation points
accepted 2026-09-04T10:40:50.4533333+00:00
Tchakounte Tchakounte, Hillary 20 Reputation points
1 answer One of the answers was accepted by the question author.

Unable to onboard Sentinel workspace from Lighthouse to Defender

I got the following error "Failed to log-lighthouse workspace. Try again later." when I tried to connect a customer's Microsoft Sentinel workspace to Microsoft Defender XDR. This is to migrate Microsoft Sentinel in the Azure portal to the…

Microsoft Security | Microsoft Sentinel
asked 2026-08-13T02:35:52.1166667+00:00
Wei 40 Reputation points
accepted 2026-09-04T08:57:23.7366667+00:00
Wei 40 Reputation points
1 answer

Microsoft Sentinel Stuck in a Loop in the Defender Portal

In the microsoft defender portal with sentinel, i have connected, disconnected and waited 30 minutes, and reconnected the SIEM workspace. if i go to sentinel and any of the tabs in defender, it just loops to the connectors page as if the workspace is not…

Microsoft Security | Microsoft Sentinel
asked 2026-05-12T03:48:26.8633333+00:00
Malaurm 0 Reputation points
commented 2026-09-02T07:45:09.65+00:00
Manivel K 20 Reputation points
3 answers

Cannot onboard Okta Single Sign on logs to Sentinel UEBA

Hi, I am trying to connect Okta to Sentinel UEBA. When I attempt to do this in the Defender XDR portal, I receive an error message saying, 'Data source is not ingested to Sentinel'. The selector to enable the functionality is greyed out. I have: …

Microsoft Security | Microsoft Sentinel
asked 2026-08-18T22:21:49.6166667+00:00
Michael Ross 0 Reputation points
answered 2026-09-01T12:36:03.6466667+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador
1 answer

Microsoft Sentinel UEBA data source fails with InternalServerError (HTTP 500)

Hi, I am trying to enable an additional AWS CloudTrail data source under Microsoft Sentinel UEBA in the Microsoft Defender portal. The AWSCloudTrail table is already receiving data normally in Sentinel. I also checked the CloudTrail data and confirmed…

Microsoft Security | Microsoft Sentinel
asked 2026-08-08T10:25:16.79+00:00
Aditya Beniwal 26 Reputation points
answered 2026-08-31T11:10:44.67+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador
1 answer

How to ingest Windows Event Logs from Tenant B's WEC (native Azure VM) to Tenant A?

We've deployed lighthouse on Tenant B to give permission on Tenant A's Admin. We have a DCR that is already there associated with our on prem WEC and that's ingesting logs to WindowsEvent Table. We have successfully associated Tenant B's WEC to our DCR…

Microsoft Security | Microsoft Sentinel
asked 2026-08-18T09:09:01.6333333+00:00
Dominador Razon 0 Reputation points
answered 2026-08-31T11:09:05.3+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador
1 answer

Secondary Sentinel workspace not visible in Defender portal

Summary Created a new Sentinel workspace (testspace) in our test subscription. It shows Connected and Active in Microsoft Defender, and I have Owner access to the subscription, resource group, and workspace plus Defender Read & Manage…

Microsoft Security | Microsoft Sentinel
asked 2026-08-20T11:36:46.48+00:00
Akshay Gopinath 0 Reputation points
answered 2026-08-31T11:05:32.65+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador
1 answer

Playbooks not listed and "Failed to fetch playbook runs in one or more selected subscriptions" appeared suddenly across multiple tenants

We are an MSSP managing multiple Microsoft Sentinel workspaces across separate customer tenants via Azure Lighthouse. As of today, the Automation / Active playbooks view fails to list playbooks and returns "Failed to fetch playbook runs in one or…

Microsoft Security | Microsoft Sentinel
asked 2026-08-27T16:17:22.7166667+00:00
Ayax OC 20 Reputation points
answered 2026-08-31T11:02:58.68+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador
1 answer One of the answers was accepted by the question author.

Sentinel workspace tables not appearing in Defender portal advanced hunting schema

Microsoft Sentinel workspace tables are not queryable in the Defender portal advanced hunting page. The Schema tab only shows six Defender XDR tables and no workspace table group appears. Querying AzureActivity returns a semantic error saying it failed…

Microsoft Security | Microsoft Sentinel
asked 2026-08-29T13:54:57.6966667+00:00
ChungJeong Woo 20 Reputation points
accepted 2026-08-31T11:01:53.53+00:00
ChungJeong Woo 20 Reputation points
1 answer

Microsoft Sentinel – “Failed to fetch playbook runs in one or more selected subscriptions” and Playbook List not showing in Run playbook on incident sentinel area

We are facing an issue while trying to manually execute a Microsoft Sentinel playbook from a Sentinel incident. When we open an incident and select Actions → Run playbook, the playbook pane does not load any available playbooks. Instead, we receive the…

Microsoft Security | Microsoft Sentinel
asked 2026-08-27T13:18:26.9066667+00:00
Sayan Dutta 105 Reputation points
answered 2026-08-27T13:19:20.0966667+00:00

AI answer

0 answers

Governance relationships can't co-exist with pre-configured GDAP admin relationship

I operate for an MSSP, we are CSP as well. Below is our setup - We have GDAP setup for our clients to support their 365 services. We have Azure lighthouse to centrally manage their subscriptions. Microsoft announced last year that Sentinel is going…

Microsoft Security | Microsoft Sentinel
asked 2026-08-13T09:19:57.15+00:00
Khanna, Keshav 20 Reputation points
commented 2026-08-26T15:52:38.1166667+00:00
Patsy Pollice 0 Reputation points
2 answers

Clarification on Scheduling Capability for Azure/Microsoft Sentinel Workbooks

Do Azure/Microsoft Sentinel workbooks support native scheduling (auto-refresh or timed execution) and/or scheduled report/export generation? If not, what is the Microsoft-recommended approach (e.g., Logic Apps, KQL jobs, Power BI) to achieve scheduled…

Microsoft Security | Microsoft Sentinel
asked 2026-08-17T00:44:04.5033333+00:00
Chamu Dass Boopathy 0 Reputation points
answered 2026-08-17T01:33:36.0166667+00:00
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator
2 answers

how can participate for Advanced KQL for SecOps?

how can participate for Advanced KQL for SecOps? Best Regards. Ignacio.

Microsoft Security | Microsoft Sentinel
asked 2025-11-14T15:11:09.19+00:00
Nacho 0 Reputation points
commented 2026-08-10T19:11:30.1466667+00:00
mlarkin 5 Reputation points Microsoft Employee
1 answer

Validation of public IPs from microsoft

Dear Microsoft Support Team, We are reaching out to inquire about the following IP addresses: 131.107.2.221 131.107.2.131 141.107.2.61 192.167.1.2 Could you please confirm if these IP addresses are part of Microsoft services? We have received…

Microsoft Security | Microsoft Sentinel
asked 2026-08-08T08:43:23.1933333+00:00
Siddhesh Rajesh Jaiswal 20 Reputation points
edited an answer 2026-08-08T11:01:16.74+00:00
Marcin Policht 106.8K Reputation points MVP Volunteer Moderator
2 answers

Functions editing in Sentinel/Log Analytics doesn't work anymore

When I select "load code to editor" to edit a workspace function in Sentinel/LogAnalytics, the code isn't loaded in a new dedicated tab, but in the current one and treated as brand new code, that I can only save as a new function. This way I…

Microsoft Security | Microsoft Sentinel
asked 2026-07-30T09:44:31.0433333+00:00
Daniele Leopizzi 0 Reputation points
commented 2026-08-06T20:24:08.68+00:00
David Alejandro Peñaloza Farias 20 Reputation points
1 answer

Functions: Legacy Category and Load to Editor Issues

Hello all! I have observed two unsettling behaviours when navigating Microsoft Sentinel through the Portal. I no longer see Legacy Category when trying to select Group By on Functions. Only Solution and Category. I am still able to add a Legacy…

Microsoft Security | Microsoft Sentinel
asked 2026-07-22T08:17:04.0466667+00:00
Panagiotis Chatzipanagiotou 0 Reputation points
commented 2026-08-04T06:48:19.3566667+00:00
Panagiotis Chatzipanagiotou 0 Reputation points
1 answer

What could be the problem?

Logs blade in sentinel showing connection to server error. KQL queries can't retrieve data because of said error

Microsoft Security | Microsoft Sentinel
asked 2026-07-31T17:10:17.7766667+00:00
Oladele, Oluwatomiwa 0 Reputation points
answered 2026-07-31T17:10:33.1166667+00:00

AI answer

1 answer

Microsoft Graph Activity Logs (MicrosoftGraphActivityLogs) enabled correctly but table remains empty in Log Analytics/Sentinel

We have Microsoft Graph Activity Logs enabled as a category on our Microsoft Entra ID diagnostic setting, routed to a Log Analytics workspace with Microsoft Sentinel enabled. The category shows as checked/saved in both the Entra ID Diagnostic Settings…

Microsoft Security | Microsoft Sentinel
asked 2026-07-24T18:21:36.84+00:00
Brandon Mulgrew 5 Reputation points
answered 2026-07-31T07:51:58.6666667+00:00
Konstantinos Lianos 905 Reputation points Student Ambassador