How to fix data connector for MDE (Sentinel)

Voiture 0 Reputation points
2023-10-26T06:27:03.26+00:00

Can't connect Sentinel to my MDE portal as it says that I do not have the required license but I have got it and have workstation onboarded

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,041 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Clive Watson 5,951 Reputation points MVP
    2023-10-26T08:45:22.5466667+00:00

    Can I please check that you are using the Microsoft 365 Defender connector from content Hub?

    User's image

    There are other prerequisites, you also need:

    source: https://video2.skills-academy.com/en-us/azure/sentinel/connect-microsoft-365-defender?tabs=MDE

    You must have a valid license for Microsoft 365 Defender, as described in Microsoft 365 Defender prerequisites.

    Your user must be assigned the Global Administrator or Security Administrator roles on the tenant you want to stream the logs from.

    • Your user must have read and write permissions on your Microsoft Sentinel workspace.

    To make any changes to the connector settings, your user must be a member of the same Microsoft Entra tenant with which your Microsoft Sentinel workspace is associated.

    Install the solution for Microsoft 365 Defender from the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box content.