MimecastAudit - Unable to deploy data connector via ARM template - Data collection rule failing creation

[shaunyb93]

Hi,

I am trying to deploy the MimecastAudit DataConnector via ARM template: https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy

The deployment is failing on creation of the Data Collection rule with the below error:

{ "code": "InvalidPayload", "message": "Data collection rule is invalid", "details": [ { "code": "InvalidOutputTable", "target": "properties.dataFlows[0]", "message": "Table for output stream 'Custom-Audit_CL' is not available for destination 'RuleDestAqys35xelo4c3w'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule." }, { "code": "InvalidOutputTable", "target": "properties.dataFlows[0]", "message": "Custom table for stream 'Custom-Audit_CL' is not available for destination 'RuleDestAqys35xelo4c3w'. Please ensure that the table exists in Log Analytics Workspace before creating or updating the rule." } ] }

To Reproduce Steps to reproduce the behaviour:

1. Begin custom deployment for ARM template https://aka.ms/sentinel-MimecastAuditAzureDeploy-azuredeploy
2. Fill out instance details
3. Select "Create"

Expected behaviour Expect the ARM template deployment to complete without error

Screenshots

I am thinking that the issue is that The Data Collection rule should be outputting to "[concat(parameters('MimecastAuditTableName'), '_CL')]" and not "[concat('Custom-', parameters('MimecastAuditTableName'), '_CL')]" as this table is not expected to exist.

Please advise on whether this issue can be resolved.

Thanks SB

[NickCloudGuard]

This error is consistent across the Mimecast data connectors ARM templates, it's not unique to just the Audit connector. Other than the table name being different, everything in the error is the same across the other Mimecast connectors.

[shaunyb93]

@NickCloudGuard I presumed this would be the case although didn't go as far as trying to deploy the other connectors. Also, the Azure Functions Linux Consumption hosting plan (deployed as part of the ARM template) is being retired: https://azure.microsoft.com/en-us/updates?id=499451 not sure if Mimecast/Msft are doing anything about this yet