Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspace

Overview

The Defender XDR data connector forwards the unified Defender incident stream to Microsoft Sentinel. For AI workloads, this includes correlated incidents that span identity, cloud posture, and AI threat protection — signals that Defender XDR has already assembled into a single incident. Without this connector, those incidents exist only in the Defender portal, unavailable to Sentinel analytics rules or automated playbooks. This check verifies the connector is enabled and receiving data on at least one Sentinel-onboarded workspace.

When the Defender XDR connector is not enabled, the unified Defender incident stream never reaches Sentinel. Threat actors who operate through a compromised agent identity generate correlated signals across Defender for Identity, Defender for Cloud, and Defender for Cloud Apps simultaneously — but without this connector those signals remain isolated in the Defender XDR portal, unavailable to Sentinel analytics rules or automated playbooks. Without this connector, the organization cannot act on the correlated AI security incident that Defender XDR has already assembled, instead receiving three independent sub-signals that may each be dismissed as routine.

Remediation

• Connect Microsoft Defender XDR to Microsoft Sentinel
• Defender XDR alerts in Microsoft Sentinel

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Low
Impact on users	Low
Pillar	AI
Category	AI Threat Detection
Product	Azure
Feature	Microsoft Sentinel
Area	Logging and detection
Licence	WIN_DEF_ATP, MDATP_XPLAT, ATA, ADALLOM_STANDALONE, THREAT_INTELLIGENCE, IDENTITY_THREAT_PROTECTION, IDENTITY_THREAT_PROTECTION_FOR_EMS_E5, SPE_E5, Consumption-based: Microsoft Sentinel
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.