Azure Workbook not ingesting defender Table not ingesting to my workbook

Ord, Joseph 0 Reputation points
2026-06-02T15:20:39.3766667+00:00

I have an issue, I am attempting to create a workbook in the new sentinel pane under the security.microsoft.com portal.

In simple terms one of the tables I am wanting to query is DeviceTvmSecureConfigurationAssessment - I have a query that i want to return the results of within this workbook. Problem is that it seems to not allow me to query any defender tables as i assume it is using the sentinel logs. I have toyed around with the source of the query within the workbook but it doesnt appear i have any advanced hunting/ defender specific areas i should be querying other than the logs (workspace).

I assumed that the solution to this previously was the defender xdr connector within sentinel but even that has been deprecated and did not ingest this table anyway. All documentation i find says that the deprecation of this connector is because this data will be ingested as sentinel and xdr unify, still i seem to have no luck.

Any ideas? thanks.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest

  1. AI answer

    2026-06-02T15:20:57.3233333+00:00

    DeviceTvmSecureConfigurationAssessment and other Microsoft Defender XDR “Advanced hunting” tables are not Sentinel log tables. In the unified Sentinel experience in the Defender portal, workbooks still run on top of a data source, and by default that data source is the Sentinel Log Analytics workspace, not the Defender XDR hunting schema.

    From the available information:

    1. Workbooks in the Defender portal
      • Azure workbooks remain the primary visualization tool and behave the same in the Defender portal as they did in the Azure portal.
      • To use workbooks with data from Advanced hunting, logs must be ingested into Microsoft Sentinel first: “To use workbooks with data from Advanced hunting, make sure that you ingest logs into Microsoft Sentinel.”
      • This means a workbook can only query tables that exist in the Sentinel workspace (or another configured data source such as Sentinel data lake / Azure Data Explorer), not the live Defender hunting schema directly.
    2. Defender XDR connector and ingestion
      • The Microsoft Defender XDR connector synchronizes incidents and alerts into Sentinel and populates tables such as SecurityAlert, SecurityIncident and related XDR incident/alert tables.
      • Ingestion of other Defender component data (for example Advanced hunting tables like DeviceInfo, DeviceFileEvents, EmailEvents, etc.) is a separate, billable data type. Only tables that are actually ingested into Sentinel (or mirrored into the Sentinel data lake) are queryable from a Sentinel workbook.
      • The connector deprecation/unification does not automatically make all Defender hunting tables available as Sentinel tables. Only the tables listed in the Sentinel tables and connectors reference, or those explicitly ingested/mirrored, are available to workbooks.
    3. Sentinel data lake option
      • Workbooks can also use the Microsoft Sentinel data lake as a data source. When using the data lake, workbooks still query KQL tables that are present in the lake. Only XDR tables that are configured to be ingested or mirrored into the data lake are available.
      • Some XDR tables can be ingested into both the analytics tier (Sentinel workspace) and the data lake tier by increasing retention beyond 30 days, or can be ingested directly into the data lake. Custom tables created via AMA/DCR or Logs Ingestion API are mirrored; MMA/legacy custom tables are not.

    Given this, the behavior seen is expected:

    • DeviceTvmSecureConfigurationAssessment is not a Sentinel workspace table by default, and the deprecated Defender XDR connector did not ingest it.
    • In the unified Sentinel experience, workbooks still cannot query Defender Advanced hunting tables unless those tables are ingested or mirrored into Sentinel (workspace or data lake) as documented.

    Actionable options based on the documentation:

    1. Verify whether DeviceTvmSecureConfigurationAssessment is available as a Sentinel table or lake-mirrored table in the environment. If it is not present in the Sentinel tables and connectors reference or in the workspace schema, it cannot be queried from a Sentinel workbook.
    2. If the goal is to visualize Defender data in Sentinel workbooks, ensure that the relevant Defender data types are being ingested into Sentinel (analytics tier and/or data lake) according to the supported tables list. Only then can a workbook query them.
    3. When using the data lake as a workbook data source, select “Sentinel data lake” in the workbook data source configuration and write KQL against the tables that are actually present in the lake, with appropriate time filters and summarization for performance.

    If DeviceTvmSecureConfigurationAssessment is not one of the supported Sentinel or lake-mirrored tables, it will not be queryable from a Sentinel workbook, even in the new unified Sentinel pane in the Defender portal.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.