---
name: Sentinel Data Connector Coverage
description: Audit which Microsoft Sentinel data connectors are ingesting and report logging coverage gaps for detection and IRAP.
---

# Sentinel Data Connector Coverage

> **TL;DR:** This skill reviews every Microsoft Sentinel data connector to confirm which log sources are actively ingesting, then reports the gaps that weaken threat detection and IRAP evidence.

## What does Microsoft Sentinel data connector coverage mean?

Microsoft Sentinel is the cloud-native SIEM that ingests security logs through data connectors, each streaming events from a source such as Microsoft Defender XDR, Microsoft Entra ID, Exchange Online, Microsoft Teams, or third-party firewalls into Log Analytics tables. Coverage describes which of those connectors are installed, enabled, and actually receiving data. When a connector is missing or has gone silent, the analytics rules and Microsoft Purview audit correlations that depend on it produce no detections, leaving blind spots that an IRAP assessor will flag.

## When should you run this skill?

- "Which Sentinel data connectors are connected and which have stopped ingesting?"
- "Show me the logging coverage gaps before our IRAP assessment."
- "Are we collecting sign-in and audit logs from Microsoft Entra ID and Exchange Online?"
- "Has any data connector gone silent in the last 24 hours?"
- "What detection sources are we missing for the Essential Eight monitoring controls?"
- "Confirm our Microsoft Defender XDR and Defender for Cloud Apps logs reach Sentinel."
- "Give me a coverage scorecard for our SOC onboarding review."

## How this skill works, step by step

1. Enumerate the Microsoft Sentinel workspaces in scope and read their installed data connectors from the Content hub.
2. For each connector, read its connection status (connected, partially connected, or disconnected) without changing any configuration.
3. List the Log Analytics tables each connector targets and confirm the connector is mapped to an active source.
4. Query each target table for the most recent ingestion timestamp to detect connectors that are silent or stale.
5. Compare the active connector set against a baseline of expected security sources (identity, email, endpoint, cloud apps, and network).
6. Flag connectors that are installed but not connected, and expected sources that have no connector at all.
7. Derive a risk score: each missing or silent high-priority source (identity, audit, endpoint) adds High weight; each stale non-critical source adds Medium; fully covered sources score Low.
8. Aggregate the weighted findings into an overall coverage rating and list the highest-impact gaps first.
9. Present the read-only report with remediation pointers to the relevant Content hub solution for each gap.

## Output format

The skill returns a coverage table followed by a summary.

| Data source | Connector status | Last ingestion | Coverage gap | Risk |
| --- | --- | --- | --- | --- |
| Microsoft Entra ID | Connected | 12 min ago | None | Low |
| Microsoft Defender XDR | Connected | 8 min ago | None | Low |
| Exchange Online (audit) | Disconnected | No data | Email audit logs not ingesting | High |
| Palo Alto firewall (CEF) | Connected | 3 days ago | Source silent, likely collector outage | Medium |

Summary highlights:

- Total expected sources, active connectors, and unfilled gaps.
- Count of High, Medium, and Low risk findings.
- Overall coverage rating and the single highest-impact gap to fix first.

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Microsoft Sentinel data ingestion and connectors | Microsoft Sentinel (Azure subscription, pay-as-you-go or commitment tier) |
| Microsoft Defender XDR connector log sources | Microsoft 365 E5 or equivalent security add-on |

### Least-privilege roles

- Microsoft Sentinel Reader (read connectors, tables, and ingestion status)
- Log Analytics Reader (query last-ingestion timestamps)

### Microsoft Graph permissions (read-only)

- Microsoft Sentinel data connectors are administered through the Azure or Microsoft Defender portal and the Azure Resource Manager and Log Analytics query APIs, not Microsoft Graph. Inspect them with the Microsoft Sentinel Reader and Log Analytics Reader Azure RBAC roles rather than Microsoft Graph scopes.

## Scope and safety

This skill is read-only by default. It inspects connector status and ingestion timestamps and never enables, disables, or reconfigures a connector.

This skill does NOT:

- Install, enable, or modify any data connector or Content hub solution.
- Change data collection rules, table schemas, or ingestion filters.
- Read or export the contents of ingested log events.
- Alter analytics rules, workbooks, or any Sentinel configuration.

## Sources and compliance

- [Connect data sources to Microsoft Sentinel by using data connectors](https://learn.microsoft.com/en-us/azure/sentinel/connect-data-sources)
- [Find your Microsoft Sentinel data connector](https://learn.microsoft.com/en-us/azure/sentinel/data-connectors-reference)
- Maps to the Essential Eight monitoring expectation that security-relevant logs are centrally collected and retained for detection and incident response; supports ISM event logging and monitoring controls.
- [ASD Essential Eight Maturity Model](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/essential-eight/essential-eight-maturity-model)
- Output in Australian English.