Microsoft Sentinel- Microsoft Dataverse data connector

Corey Mechalske 60 Reputation points
2025-08-21T22:56:36.26+00:00

I configured the Microsoft Dataverse connector in Microsoft Sentinel. I have a few prod dataverse environments.

  • Enabled global audit logging
  • Enabled entity table logging
  • Imported the Microsoft Sentinel: Audit Settings (Dataverse) solution
  • Purview Audit is enabled
  • In GCC environment
  • I have RBAC roles assigned using IAM

For some reason, I am not getting any logs being ingested into Sentinel from the Dataverse Connector.

Microsoft Security | Microsoft Sentinel
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Pauline Mbabu 1,410 Reputation points Microsoft Employee
    2025-08-28T14:15:08.8533333+00:00

    Hello @Corey Mechalske ,
    Thank you for reaching out. I am not sure if this remains to be a challenge but if it, here are some troubleshooting steps you can take:
    If your Microsoft Dataverse connector in Microsoft Sentinel appears connected but no logs are being ingested, start by double checking that audit logging is fully enabled both globally in Purview and at the entity level for all relevant tables.

    Use the Microsoft Purview Compliance Portal to confirm that logs are being generated; if no events show up, the issue lies with audit configuration.
    After setup, allow 60–120 minutes for logs to appear and generate test activity to validate ingestion.

    Finally, use the SentinelHealth table to diagnose connector errors or ingestion failures by checking for relevant status codes or messages.
    If there is no data in the SentinelHealth table, you'll need to enable this by going to your Sentinel workspace > Settings > Settings (again) >Auditing and health monitoring > Configure diagnostic settings.
    I hope you find this helpful. Please leave a comment, incase this still remains a challenge.

    If you find the answer above helpful, please Accept the answer to help anyone in the community who might have a similar question to quickly find the solution.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.