# Microsoft Defender XDR (unified) data connector is enabled on the Microsoft Sentinel workspace
The Defender XDR data connector forwards the unified Defender incident stream to Microsoft Sentinel.
Source: https://maester.dev/docs/tests/ZTA.61024
## Overview
The Defender XDR data connector forwards the unified Defender incident stream to Microsoft Sentinel. For AI workloads, this includes correlated incidents that span identity, cloud posture, and AI threat protection — signals that Defender XDR has already assembled into a single incident. Without this connector, those incidents exist only in the Defender portal, unavailable to Sentinel analytics rules or automated playbooks. This check verifies the connector is enabled and receiving data on at least one Sentinel-onboarded workspace.
When the Defender XDR connector is not enabled, the unified Defender incident stream never reaches Sentinel. Threat actors who operate through a compromised agent identity generate correlated signals across Defender for Identity, Defender for Cloud, and Defender for Cloud Apps simultaneously — but without this connector those signals remain isolated in the Defender XDR portal, unavailable to Sentinel analytics rules or automated playbooks. Without this connector, the organization cannot act on the correlated AI security incident that Defender XDR has already assembled, instead receiving three independent sub-signals that may each be dismissed as routine.
## Remediation
- [Connect Microsoft Defender XDR to Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/connect-microsoft-365-defender)
- [Defender XDR alerts in Microsoft Sentinel](https://learn.microsoft.com/azure/sentinel/microsoft-365-defender-sentinel-integration)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Threat Detection |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| Licence | WIN_DEF_ATP, MDATP_XPLAT, ATA, ADALLOM_STANDALONE, THREAT_INTELLIGENCE, IDENTITY_THREAT_PROTECTION, IDENTITY_THREAT_PROTECTION_FOR_EMS_E5, SPE_E5, Consumption-based: Microsoft Sentinel |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.