How to resolve about Sentinel and XDR not connecting properly.

Question

How to resolve about Sentinel and XDR not connecting properly.

Ryo Suzuki 25

We are currently doing integration testing between Sentinel and XDR.
After onboarding and offboarding the workspace from XDR side several times ,following the steps provided in Microsoft's official documentation, encountered the following symptoms.

To collect incidents ＆ alerts on XDR, we had Installed Microsoft Defender XDR Connector.now appearing the message "One or more of your workspaces are onboarded to USX.Incidents and alerts configuration is disabled."

it seems no exist other workspace on the same tenant and already removed old workspace data from XDR.

Also, we had checked prequsites following this aricle ; https://learn.microsoft.com/en-us/azure/sentinel/connect-microsoft-365-defender?source=recommendations&tabs=MDE#prerequisites

And, checking and tried to this method following these articles,too ;

https://techcommunity.microsoft.com/discussions/microsoftsentinel/defender-streaming-api-is-not-removed-during-offboarding-process-and-cannot-be-d/3618325

https://learn.microsoft.com/en-us/answers/questions/1661212/integrating-microsoft-sentinel-with-microsoft-defe

What shoud we do ?

What's the cause of this symptom? hope to integrate with Sentinel and XDR as USX again !

we have been spending many time to fixing about this for about 50 days.

Givary-MSFT 35,596 Reputation points Microsoft Employee Moderator

2024-11-26T08:46:21.49+00:00

@Ryo Suzuki Thank you for reaching out to us, let me research on this issue and revert back.

In the meantime could you please share your contact details in order to have a session over the teams for better understanding of the issue.

Please send me an email to '[email protected]' with Sub - Attn: Givary and following details in the email body:

Link to this thread/post
Shubham Pandey 0 Reputation points

2025-03-29T15:56:16.7133333+00:00

@Givary-MSFT May I get the solution how it's resolved ?

Accepted answer

1 additional answer

Your answer

Givary-MSFT 35,596 Reputation points Microsoft Employee Moderator

2024-11-26T08:46:21.49+00:00

@Ryo Suzuki Thank you for reaching out to us, let me research on this issue and revert back.

In the meantime could you please share your contact details in order to have a session over the teams for better understanding of the issue.

Please send me an email to '[email protected]' with Sub - Attn: Givary and following details in the email body:

Link to this thread/post
Shubham Pandey 0 Reputation points

2025-03-29T15:56:16.7133333+00:00

@Givary-MSFT May I get the solution how it's resolved ?

Answer 1

Givary-MSFT 35,596 Microsoft Employee Moderator

@Ryo Suzuki Please capture browser trace at the time of issue (HAR trace)
Refer to this links on the steps how to capture

https://learn.microsoft.com/en-us/azure/azure-portal/capture-browser-trace

https://www.youtube.com/watch?v=thsPBE0lA5I

Also, help me with the tenant id to investigate this further.

Share these details over the email '[email protected]' with Sub - Attn: Givary

Givary-MSFT 35,596 Reputation points Microsoft Employee Moderator

2024-12-02T12:20:35.9833333+00:00

@Ryo Suzuki We connected offline and reviewed the logs with assistance from the engineering team. With their help, we successfully resolved the issue.

If you have any further questions, please feel free to post them here!
Ryo Suzuki 25 Reputation points

2024-12-05T05:24:23.4166667+00:00

@Givary-MSFT Thank you for your support this time!
Givary-MSFT 35,596 Reputation points Microsoft Employee Moderator

2024-12-09T07:09:36.7033333+00:00

@Ryo Suzuki Our engineering team conducted a detailed investigation and discovered that the XDR was connected to a workspace that had been deleted a few months ago. This was the reason for your inability to connect to Sentinel from XDR.

Over the weekend, our team resolved the issue, and you confirmed via Teams that after these changes, you were able to connect to Sentinel from XDR without any problems.
Ryo Suzuki 25 Reputation points

2024-12-09T11:27:50.67+00:00

Thank you so much ,Givary!!!!

This sympton was resolved by Givary and spledid support engineering team!
Also, I was so impressed your passion for Microsoft customers....

You had spent for many time for us until today.

To be honest,we were really at a loss for 70days ....

During that time,you had never igonored us on this discussion board.

I would like to applogies you for such a rudeness behaiviour this time.

Many many thanks to you and will take an active role on your field, Givary!!!!
Cheeeeeer up from Japan!!!!!!

Your support has made me love Microsoft even more!
Shubham Pandey 0 Reputation points

2025-03-29T15:55:23.62+00:00

Hi Team,

I'm facing exact same issue after changing the workspace in defender. Kindly suggest the solution.
Ryo Suzuki 25 Reputation points

2025-03-30T00:06:27.04+00:00

Hi, @Shubham Pandey.

I wish my comment will help you for solving a similar issue.

Have you deleted a resource group including Sentinel resource from Azure side ,before

disconnecting XDR Connector from MS Defender XDR Portal?

This case happen that trigger by disconnect from Azure side forcedly.

Givary and Sentinel support team helped me change the settings from the MS architecture side after all.they were so kind and provided splendid support last time!

Really appreciate them!

so I would strongly recommend you to read following Link ,Also

if you will face to this symptom again, please ask Sentinel support team! I had spent time for three months about this after all.

https://learn.microsoft.com/en-us/unified-secops-platform/microsoft-sentinel-onboard#offboard-microsoft-sentinel
Shubham Pandey 0 Reputation points

2025-03-31T07:02:06.6933333+00:00

Earlier a workspace was connected to xdr in defender portal. Since we migrated to different region so we created one more workspaces till the time we are not changing the workspace in xdr portal we are not getting this error but by the time we change the workspace in defender portal we are getting this issue.

Answer 2

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

2 deleted comments

Comments have been turned off. Learn more

Share via

How to resolve about Sentinel and XDR not connecting properly.

1 additional answer

Your answer