Azure-Sentinel icon indicating copy to clipboard operation
Azure-Sentinel copied to clipboard
verified publisher icon Azure

Business Premium - Advanced Hunting Schema Unified Portal

Open jackbaz opened this issue 1 month ago • 2 comments

Hi,

Before the Unified Portal change with Sentinel, business premium users were able to install the Defender XDR Data Connection and at a minimum turn on DeviceNetworkEvents and DeviceProcessEvents.

Now for any new customers where Sentinel is automatically added to Defender, the XDR Connector is not available and Business Premium users cannot ingest these tables. As Content Hub is now re-directed from the Azure Portal, there is no way I can see around this?

Can you please advise if this is expected? I understand the licensing component but this was able to be done previously and was charged, why is this no longer an option for these license types?

jackbaz avatar Nov 24 '25 01:11 jackbaz

Hello @jackbaz, thanks for flagging this issue. We will investigate this issue and get back to you with some updates. Thanks!

v-utpalkumar avatar Nov 24 '25 04:11 v-utpalkumar

Hi, any update?

jackbaz avatar Nov 28 '25 00:11 jackbaz