5.6 Enabling the M365 Defender Connector

Enabling the M365 Defender Connector

By the end of this subsection, you will have connected the M365 Defender data connector to your Sentinel workspace and verified data is flowing into the expected tables.

This is the single most important data connector for this course. It brings all Defender XDR data — endpoint, email, identity, cloud app — into your Sentinel workspace for custom analytics rules, cross-source hunting, and automated response.

What the connector ingests

Configuration walkthrough

1. In the Sentinel portal, navigate to Configuration → Data connectors
2. Search for “Microsoft Defender XDR” (formerly Microsoft 365 Defender)
3. Click Open connector page
4. Under Connect incidents and alerts, toggle to On — this sends Defender XDR incidents to your Sentinel incident queue
5. Under Connect events, select which raw event tables to ingest:

Recommended initial selection:

• DeviceProcessEvents — essential for endpoint investigation
• DeviceNetworkEvents — essential for C2 and data exfiltration detection
• DeviceLogonEvents — essential for lateral movement detection
• EmailEvents — essential for phishing investigation
• EmailUrlInfo — URL analysis in phishing campaigns
• UrlClickEvents — Safe Links click tracking
• CloudAppEvents — inbox rules, OAuth grants, cloud app activity
• IdentityLogonEvents — on-premises AD sign-in activity
• AlertInfo + AlertEvidence — cross-product alert data

Defer initially (enable when needed):

• DeviceFileEvents — high volume, enable for specific investigations
• DeviceRegistryEvents — high volume, enable for malware analysis
• DeviceImageLoadEvents — very high volume, enable for DLL sideloading hunts

6. Click Apply Changes

Data begins flowing within 5-10 minutes. The connector status changes to “Connected.”

Verification queries

After enabling the connector, verify data is flowing into each table:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

// Check which M365 Defender tables have recent data
union withsource=TableName
    DeviceProcessEvents,
    DeviceNetworkEvents,
    DeviceLogonEvents,
    EmailEvents,
    CloudAppEvents,
    AlertInfo
| where TimeGenerated > ago(1h)
| summarize EventCount = count(), LastEvent = max(TimeGenerated) by TableName
| sort by TableName asc

Ingestion latency check:

1
2
3
4
5
6
7

EmailEvents
| where TimeGenerated > ago(1h)
| extend IngestionDelay = ingestion_time() - TimeGenerated
| summarize
    AvgDelaySeconds = round(avg(IngestionDelay) / 1s, 0),
    MaxDelaySeconds = round(max(IngestionDelay) / 1s, 0),
    P95DelaySeconds = round(percentile(IngestionDelay, 95) / 1s, 0)