This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(60.8, 54%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAT%3C/text%3E%3C/svg%3E)
Sentinel workspace not appearing in Microsoft Defender XDR. It appears 0 workspaces there even are obvious in Sentinel and passed more than 24h.
Additional Microsoft Defender tools and services that provide security across various platforms and environments
Hello Konstantinos, Indeed I followed the steps you mentioned, the workspace obvious in Sentinel, I can see it and is enabled but nth appears in Defender. Tenant is the same.
Hi Andreas,
Thanks for confirming. If the workspace is visible and enabled in Microsoft Sentinel in the Azure portal, but 0 workspaces appear in Defender, I would next verify the onboarding permissions, not only the workspace status.
For connecting Sentinel to the Defender portal, Microsoft requires the user doing the onboarding to have:
Security Administrator or higher in Microsoft Entra ID
Owner or User Access Administrator on the subscription
Microsoft Sentinel Contributor on the workspace, resource group, or subscription
This is separate from simply being able to see or use the Sentinel workspace.
Please try with an account that has the above permissions, then go directly to:
Microsoft Defender portal > System > Settings > Microsoft Sentinel > Connect a workspace
Microsoft’s documented flow says the workspace should be selected there and connected from that page. After connection, Sentinel should appear in the left navigation.
Hi Andreas,
Thanks for the screenshots. The workspace is definitely present in Azure Sentinel, but the IAM screenshot does not show your user account having Microsoft Sentinel Contributor. It only shows the Microsoft Threat Protection and WindowsDefenderATP service principals with that role.
That is important because the Defender portal workspace picker is permission-filtered. Microsoft states that you will not see workspaces in Defender to onboard if you do not have the required permissions. To onboard Sentinel to Defender, the signed-in user needs:
Security Administrator or higher in Microsoft Entra ID
Owner or User Access Administrator on the subscription
Microsoft Sentinel Contributor on the subscription, resource group, or workspace
For viewing Sentinel after onboarding, at least Microsoft Sentinel Reader is required.
Please check this specifically for your own user:
Azure portal > Resource group or Sentinel workspace > Access control (IAM) > Check access > your user account
Also check your Entra role separately, because Security Administrator / Global Administrator will not appear in the Azure IAM role assignment list.
If your own account does not have the required combination above, assign the roles, sign out/in, and try again from:
Microsoft Defender portal > System > Settings > Microsoft Sentinel > Connect a workspace
If your account already has all required roles and it still shows 0 items, then I would open a Microsoft support request, because your screenshots prove the workspace exists but Defender is not discovering it.
Hello @ANDREAS TSOURAS ,
This is usually not a 24h propagation issue. In Defender XDR, the workspace must be explicitly available/onboarded under System > Settings > Microsoft Sentinel > Workspaces / Connect a workspace. The list only shows Sentinel-enabled Log Analytics workspaces that your account has access to.
Please check the following:
The Log Analytics workspace has Microsoft Sentinel enabled.
You are signed in to the same Entra tenant as the Sentinel workspace.
Your account has the required roles. To onboard the workspace, Microsoft requires Security Administrator or higher in Entra ID, plus Owner or User Access Administrator on the subscription, and Microsoft Sentinel Contributor on the workspace/resource group/subscription. For simply viewing Sentinel in Defender, Microsoft Sentinel Reader is required.
If this is an MSSP / cross-tenant scenario, don’t rely only on GDAP + Azure Lighthouse, because Microsoft notes that this isn’t supported for Sentinel data in the Defender portal; use Entra B2B access instead.
Once the workspace is connected, Microsoft Sentinel should appear in the Defender portal navigation and the workspace should be visible under the Sentinel settings. If all permissions and tenant context are correct but it still shows 0 workspaces, I’d open a Microsoft support request because that points to a backend/onboarding issue rather than normal delay.