Issues with connecting Microsoft Sentinel to AWS manually, AWS SENTINEL not ingesting logs

Anonymous
2025-12-30T14:57:37.41+00:00

I am referencing this page for instructions: https://learn.microsoft.com/en-us/azure/sentinel/connect-aws?tabs=s3#manual-setup

However, the Microsoft Sentinel is still not ingesting logs from AWS. I have looked at the troubleshooting page as well to double check the configuration, and everything looks good.

On my end, there's two things I noticed. We're using 19785706532 for our accountId in the trust policy. This was gathered from Google, as the file CF file did not have the accountId

AWS: !Sub "arn:${AWS::Partition}:iam::${SentinelAWSAccount}:root

The second problem is step 2, which indicates OIDC and for AWS we already use an identity provider PING.

I notice the role being assumed in CloudTrail. So my questions are do we need to set up OIDC if we already have an identity provider in AWS we use for SSO?

Is there anyway to find or confirm what is the SentinelAwsAccountId? As I do not see this in the repo.


Moved from: Community Center | Not monitored

Microsoft Security | Microsoft Sentinel

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.