At least one Microsoft (first-party) data connector is configured in every Microsoft Sentinel workspace
Overview
Section titled “Overview”Microsoft first-party data connectors (Microsoft Entra ID sign-in and audit logs, Microsoft Defender XDR, Microsoft 365 Defender, Microsoft Defender for Cloud, Office 365 activity, Microsoft Defender for Cloud Apps, Microsoft Threat Intelligence, Azure Activity, and similar) are the highest-fidelity telemetry sources Sentinel can consume because they emit normalized, signed, identity-tagged events directly from the Microsoft control plane with no agent translation.
Without these connectors, Sentinel has no visibility into the very platform the customer pays Microsoft to operate: a threat actor performing password spray, MFA fatigue, or token-replay against Microsoft Entra ID generates Entra sign-in events that never reach the workspace and therefore never trigger any built-in analytics rule, fusion correlation, or UEBA baseline.
The same gap applies to Microsoft Defender XDR alerts (Defender for Endpoint malware detonations, Defender for Identity DCSync alerts, Defender for Office 365 phish detonation, Defender for Cloud Apps anomalous OAuth grants), which would otherwise stream into Sentinel for cross-product correlation and incident creation. Configuring at least one Microsoft connector is the minimum viable detection surface; production deployments typically enable Microsoft Entra ID, Microsoft Defender XDR, Azure Activity, and Office 365 at a minimum.
Remediation
Section titled “Remediation”- Connect Microsoft service data sources
- Connect Microsoft Entra ID to Microsoft Sentinel
- Connect Microsoft Defender XDR to Microsoft Sentinel
- Connect Azure Activity to Microsoft Sentinel
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | Azure |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.