# Third-party (non-Microsoft) data connectors are configured in Microsoft Sentinel for non-Microsoft workloads in scope
Most enterprise estates run workloads outside Microsoft control planes — AWS accounts, Google Cloud projects, on-premises Linux/Windows servers emitting…
Source: https://maester.dev/docs/tests/ZTA.41202
## Overview
Most enterprise estates run workloads outside Microsoft control planes — AWS accounts, Google Cloud projects, on-premises Linux/Windows servers emitting Syslog/CEF, third-party identity providers (Okta), endpoint security stacks (CrowdStrike, SentinelOne), email security gateways (Proofpoint, Mimecast), network appliances (Palo Alto Networks, Fortinet, Cisco ASA/FTD), CASBs, and SaaS audit logs. When these sources are not connected to Sentinel, the SIEM has a one-sided view of the kill chain: Sentinel can detect a Microsoft Entra sign-in but cannot see the preceding AWS IAM CreateAccessKey, the on-premises Linux SSH brute force, the perimeter firewall command-and-control beacon, or the third-party EDR malware detonation that precedes lateral movement. Threat actors operate end-to-end across Microsoft and non-Microsoft surfaces, and a SIEM that ignores the non-Microsoft surface produces detection-blind windows large enough for a full intrusion lifecycle to complete. Sentinel exposes built-in third-party connectors (AmazonWebServicesS3, GCP, Syslog/CEF, Okta SSO, codeless connectors for SaaS APIs) precisely so the SIEM can correlate identity, endpoint, network, and cloud events across the customer's full estate.
## Remediation
- [Connect AWS to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-aws)
- [Connect GCP to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-google-cloud-platform)
- [Collect Syslog/CEF logs](https://learn.microsoft.com/azure/sentinel/connect-cef-syslog-ama)
- [Find your Microsoft Sentinel data connector](https://learn.microsoft.com/azure/sentinel/data-connectors-reference)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Medium |
| Impact on users | Low |
| Pillar | SecOps |
| Category | Security information and event management |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.