'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Fix Microsoft Sentinel Not Receiving Defender for Cloud Apps Logs
Question details
The user is unable to view Microsoft Defender for Cloud Apps logs within Microsoft Sentinel after configuring the integration.
- Product
- Microsoft Sentinel
- Device & OS
- not provided
- Scenario
- Configuring the Defender for Cloud Apps connector and Sentinel integration for SIEM data collection.
- Observed behavior
- Cloud Apps logs do not appear in Microsoft Sentinel, and the SIEM agent fails to check in.
Ensure you have the appropriate global administrator or security administrator permissions in your Azure Active Directory tenant before reviewing or modifying data connector settings.
Verify Connector Configuration and Open a Support Ticket
Check your basic integration settings before escalating the backend issue to Microsoft Support.
In many cases, missing logs are caused by misconfigured workspace permissions or backend service delays. Following these verification steps will ensure your local configuration is correct before requesting Microsoft intervention.
Navigate to the Microsoft Sentinel workspace, select Data connectors from the left menu, and ensure the Microsoft Defender for Cloud Apps connector status shows as connected.
Confirm that your account has the necessary permissions to read and write data to the designated Log Analytics workspace used by Sentinel.
Open the connector configuration page and verify that the specific data types you want to ingest, such as Discovery logs or Alerts, are properly checked and saved.
If the settings are correct but the SIEM agent still fails to check in, navigate to the Help + support section in the Azure portal and open a support ticket with the Microsoft Defender for Cloud Apps support team for backend investigation.
Manage Your IT Reports and Logs Documentation with WPS Office
While waiting for Microsoft Support to resolve your Sentinel log issues, you can easily document your troubleshooting steps, IT reports, and system architectures using WPS Office. It is a highly compatible, free, and lightweight alternative to Microsoft Office that ensures seamless workflow continuity.
- 1. Download the Installer: Visit the official WPS Office website and download the free installer tailored for your operating system.
- 2. Install WPS Office: Run the downloaded installer and follow the simple on-screen instructions to set up the software.
- 3. Open Your IT Documents: Launch WPS Writer or Spreadsheet to begin seamlessly documenting your Sentinel integration architecture and support logs.
Frequently Asked Questions
Why is my SIEM agent not checking in with Microsoft Sentinel?
The SIEM agent might fail to check in due to network connectivity issues, misconfigured authentication tokens, or backend service delays within the Defender for Cloud Apps infrastructure.
How long does it take for Defender for Cloud Apps logs to appear in Sentinel?
After initial configuration, it can take up to 15-30 minutes for logs to begin populating in your Log Analytics workspace. If nothing appears after a few hours, re-verify your connector settings.
Do I need special licenses to integrate Defender for Cloud Apps with Sentinel?
Yes, you must have an active Microsoft Sentinel workspace and the appropriate Microsoft 365 E5 or standalone Defender for Cloud Apps licenses to enable and utilize the data connector.
