Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,268 questions
Microsoft sentinel not ingesting M365 connector data
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 79%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBD%3C/text%3E%3C/svg%3E)
Brandon DeVane
0
Reputation points
Greetings, we have this situation where the data connector for M365 isn't ingesting logs to sentinel. The connector shows as connected, but no logs are being ingested
From the health data, they give this message: "Tenant does not exist in the O365 Management API." With the recommended action: "Unified auditing is not enabled for the tenant in O365. Enable unified auditing in O365."
The status code for this is: SC20011
I verified that unified auditing IS enabled in our tenant. This happens for all of the connector types, exchange, sharepoint, and teams. Any idea how to correct this issue? The Microsoft Entra ID connector, and the Azure Activity connector are working fine. It just seems to be an issue with M365
Microsoft Sentinel
Sign in to answer