The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status.

Question

The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status.

Brooks Lowe 0

The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status. My CISO who is a owner over all subscription has the same issues.

Brooks Lowe 0 Reputation points

2025-11-26T19:14:46.4833333+00:00
Review Audit Logs: Look at the audit logs for any errors or warnings that might provide insight into why the connector is not connecting successfully.

Where do I look for those audit logs?
Sridevi Machavarapu 7,940 Reputation points Microsoft External Staff Moderator

2025-12-04T03:36:02.69+00:00
Hello Brooks Lowe,

Based on your description, I understand that you have installed the Azure Activity Data Connector in Microsoft Sentinel and successfully completed the Azure Policy Assignment Wizard. However, the Data Connector status remains Not Connected, and no data is being ingested.

Please follow the below steps to make the status Connected.

Sign in to the Azure Portal and navigate to Subscriptions.

Select the relevant subscription and go to Activity Log.

Click on Export Activity Logs → Under the Diagnostic Settings page, select "Add Diagnostic Setting".

In the Diagnostic Settings page:

Provide a name for the setting.

Select all logs to collect.

Under Destination details, choose "Send to Log Analytics workspace".

Select your subscription and the targeted Log Analytics workspace.

Click Save, then verify that the setting has been created successfully.

Allow at least 45 minutes to 1 hour for the Data Connector status to update to Connected.

Please refer to the screenshot below for a clearer understanding.

Also, check if your policy assignment scope is subscription only. Not subscription/Resource Group

E.g. This would work

This won't

For more details you can refer this QnA post on same issue: https://learn.microsoft.com/en-us/answers/questions/2143871/how-to-connect-azure-activity-data-connector-in-se

I hope this information is helpful. Please feel free to reach out if you have any further questions.

1 answer

Your answer

Brooks Lowe 0 Reputation points

2025-11-26T19:14:46.4833333+00:00

Review Audit Logs: Look at the audit logs for any errors or warnings that might provide insight into why the connector is not connecting successfully.

Where do I look for those audit logs?
Sridevi Machavarapu 7,940 Reputation points Microsoft External Staff Moderator

2025-12-04T03:36:02.69+00:00

Hello Brooks Lowe,

Based on your description, I understand that you have installed the Azure Activity Data Connector in Microsoft Sentinel and successfully completed the Azure Policy Assignment Wizard. However, the Data Connector status remains Not Connected, and no data is being ingested.

Please follow the below steps to make the status Connected.

Sign in to the Azure Portal and navigate to Subscriptions.

Select the relevant subscription and go to Activity Log.

Click on Export Activity Logs → Under the Diagnostic Settings page, select "Add Diagnostic Setting".

In the Diagnostic Settings page:

Provide a name for the setting.

Select all logs to collect.

Under Destination details, choose "Send to Log Analytics workspace".

Select your subscription and the targeted Log Analytics workspace.

Click Save, then verify that the setting has been created successfully.

Allow at least 45 minutes to 1 hour for the Data Connector status to update to Connected.

Please refer to the screenshot below for a clearer understanding.

Also, check if your policy assignment scope is subscription only. Not subscription/Resource Group

E.g. This would work

This won't

For more details you can refer this QnA post on same issue: https://learn.microsoft.com/en-us/answers/questions/2143871/how-to-connect-azure-activity-data-connector-in-se

I hope this information is helpful. Please feel free to reach out if you have any further questions.

Answer 1

If the Azure Activity connector for Microsoft Sentinel is not showing a connected status despite multiple attempts to install it through the launch wizard, consider the following troubleshooting steps:

Confirm Connector Prerequisites and Permissions: Ensure that all prerequisites for the connector are met and that the necessary permissions are granted. Since your CISO has owner permissions, this should typically not be an issue, but it's worth double-checking.
Validate Schema Alignment: Check if there are any schema alignment issues that could be preventing the connector from functioning properly.
Reapply Configuration: Sometimes, simply reapplying the configuration can resolve connection issues.
Check for Known Issues: Review the troubleshooting documentation for any known issues related to the Azure Activity connector that might be affecting connectivity.
Review Audit Logs: Look at the audit logs for any errors or warnings that might provide insight into why the connector is not connecting successfully.

If these steps do not resolve the issue, consider reaching out to Microsoft support for further assistance, as they may have additional insights or tools to diagnose the problem.

Share via

The azure activity connector for Azure sentinel is not working. I've run through the launch wizard and install multiple times and cannot get a connected status.

1 answer

Your answer