This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 79%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBD%3C/text%3E%3C/svg%3E)
Greetings, we have this situation where the data connector for M365 isn't ingesting logs to sentinel. The connector shows as connected, but no logs are being ingested
From the health data, they give this message: "Tenant does not exist in the O365 Management API." With the recommended action: "Unified auditing is not enabled for the tenant in O365. Enable unified auditing in O365."
The status code for this is: SC20011
I verified that unified auditing IS enabled in our tenant. This happens for all of the connector types, exchange, sharepoint, and teams. Any idea how to correct this issue? The Microsoft Entra ID connector, and the Azure Activity connector are working fine. It just seems to be an issue with M365
Hello @Brandon DeVane,
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hello @Brandon DeVane,
After installing the Microsoft 365 (formerly Office 365) Data Connector, how long did you wait to check if the logs were being ingested? Typically, it can take 2–3 hours for the logs to start appearing.
Please wait at least 3 hours and verify if the logs are being ingested. If you're still not seeing any data, kindly share a screenshot of your connector page for further review.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(224.00000000000003, 60%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EB%3C/text%3E%3C/svg%3E)
Hello, the connector has been online for more than a week. Logs still are not being ingested.
I also confirmed logs are showing up for exchange/sharepoint in the audit section of the security admin page. Not sure why it does not get to sentinel
Hello @bdevane,
Thank you for your response.
If you're still experiencing the issue, I recommend reinstalling the Microsoft 365 (formerly Office 365) data connector in your portal. You can do this by deleting the existing connector and then reinstalling it from the Content Hub.
Please let me know if the issue persists after reinstallation.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(236.8, 69%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EE%3C/text%3E%3C/svg%3E)
Hi,
I have a similar issue for now a few week, for M365 data connector and Dynamics. The issue persists after reinstallation.
Do you have any other suggestion ?
Still no resolution after re installation either. Not sure if GCC has anything to do to affect this.
I've disabled and re-enabled unified auditing, and reinstalling sentinel and making a new workgroup. Still nothing
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(32, 38%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPA%3C/text%3E%3C/svg%3E)
Hi, I encountered the same problem with a client last week. I'm stuck :(. Did you manage to solve your issue ?
Hey Philippe, we resolved this finally. Not sure you figured your problem as well. Not sure if it was the same problem.
We managed to finally get this working. The problem was a back-end Microsoft issue. We were a GCC tenant "accidentally" created in the commercial tenant. (You can find this by going to admin.microsoft.com > settings > Organization profile > Data Location. (It should say Government Community Cloud if you are GCC... if it doesn't, you have a problem))
The Office 365 management API was utilizing the manage.office.com and not the manage-gcc.office.com. You can check specifically by creating an app registration and calling the manage-gcc.office.com using the Office 365 management API. If it does not exist in there, then that's your problem. After migrating from commercial to GCC (We did not submit a ticket for this, they happen to reach out and tell us specifically), and submitting a ticket for this API issue, they were able to change the back-end api to use the manage-gcc.office.com URL only after we had tried to escalate with O365 support multiple times. We had to get a larger company involved in getting this resolved as the O365 support wanted to punt us to the Entra support team which is a paid plan. No sense in paying for something when this was entirely not our fault. I hope this helps anyone who might have the same problem.