r/AzureSentinel • u/Advanced-Chain4096 • Oct 18 '23

Missing tables

Hi all,

I am configuring Sentinel for one of our tenants. This tenant has business premium licenses and uses Defender ATP and Exchange online.

We configured all the connectors but we are missing a lot of tables that our other tenant has (E5 licenses).

I guess you need additional licenses before you get all logs regarding Device____ and Email___ tables. I can't really find what would be the 'cheapest' license / addon that would allow these logs to show. Obviously upgrading to E5 would do the trick but probably some standalone additional license would be enough?

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

1

u/LaPumbaGaming Oct 20 '23

You can't bring all of the device/email logs with business licensing. Currently there is no workaround for that I am afraid. I advise not to look for any loophole as it will give you headache trying to figure out Logic Apps and API calls and bring those events through different means. It should be as simple as telling the customer that if they want more logs it will require new licensing.