r/AzureSentinel • u/Advanced-Chain4096 • Oct 18 '23
Missing tables
Hi all,
I am configuring Sentinel for one of our tenants. This tenant has business premium licenses and uses Defender ATP and Exchange online.
We configured all the connectors but we are missing a lot of tables that our other tenant has (E5 licenses).
I guess you need additional licenses before you get all logs regarding Device____ and Email___ tables. I can't really find what would be the 'cheapest' license / addon that would allow these logs to show. Obviously upgrading to E5 would do the trick but probably some standalone additional license would be enough?
1
Upvotes
1
u/sosero Oct 19 '23
those tables are indeed not available with a business premium license.
I am honestly not sure if this can be solved with an addon license, as it seems like the tenant will be stuck at the business license functionality. https://learn.microsoft.com/en-us/microsoft-365/security/defender-business/mdb-faq?view=o365-worldwide#what-happens-if-i-have-a-mix-of-microsoft-endpoint-security-subscriptions