You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/azure-storage-blob-connector-troubleshoot.md
+5-4Lines changed: 5 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Troubleshoot Azure Storage Blob connector issues in Microsoft Senti
4
4
author: EdB-MSFT
5
5
ms.author: edbaynash
6
6
ms.topic: troubleshooting
7
-
ms.date: 02/05/2026
7
+
ms.date: 02/19/2026
8
8
ms.service: microsoft-sentinel
9
9
10
10
#Customer intent: As a security engineer, I want to troubleshoot Azure Storage Blob connector issues so that I can ensure seamless log ingestion into Microsoft Sentinel.
@@ -67,7 +67,7 @@ Event Grid system topics facilitate blob created events from the source storage
67
67
1. Check the dead-letter queue (DLQ) configured for the connector. Messages that fail processing are moved to the DLQ. If the DLQ contains messages, review them for clues about the failure. For the DLQ URI, see the connector's `request.DlqUri` property in the [Azure Storage Blob connectors API reference](data-connection-rules-reference-azure-storage.md#request-configuration).
68
68
69
69
70
-
:::image type="content" source="./media/azure-storage-blob-connector-troubleshoot/event-grid-subscription-metrics.png" lightbox="./media/azure-storage-blob-connector-troubleshoot/event-grid-subscription-metrics.png" alt-text="Screenshot of Event Grid system topic additional features tab.":::
### Cause 3: The Azure Storage Blob connector permissions or networking policies aren't set properly
73
73
@@ -95,9 +95,10 @@ If the service principal and RBAC troubleshooting doesn't surface an issue, the
95
95
- If NSP is being used to protect the account, enable the [perimeter's diagnostic logs](/azure/private-link/network-security-perimeter-diagnostic-logs) to troubleshoot. NSP rules only apply to resources in **Enforced** access mode. Alternatively, **Transition** mode doesn't apply the rules on the resource while continuing to collect telemetry on traffic patterns. Review the profile associated with the storage account(s):
96
96
- Check that inbound rules for the producer are in place. Check for blob write failures on the producer.
97
97
- Check that inbound rules for the connector are in place per the [Enable network security](enable-storage-network-security.md) documentation. Verify that the `Scuba` service tag IP ranges are included in the NSP inbound rules.
98
-
- Check that inbound rules include a rule for the subscription of the storage account and Event Grid system topic. Ensure the Event Grid system topic subscription is using **System Assigned** managed identity-based delivery.
98
+
- Check that inbound rules include a rule for the subscription of the storage account and Event Grid system topic.
99
+
- Ensure the Event Grid system topic subscription is using **System Assigned** managed identity-based delivery.
99
100
100
-
:::image type="content" source="./media/azure-storage-blob-connector-troubleshoot/system-topic-managed-identity-type.png" lightbox="./media/azure-storage-blob-connector-troubleshoot/system-topic-managed-identity-type.png" alt-text="Screenshot of Network Security Perimeter rules showing inbound rules for the producer and connector, including Scuba service tag and subscription rule.":::
101
+
:::image type="content" source="./media/azure-storage-blob-connector-troubleshoot/system-topic-managed-identity-type.png" lightbox="./media/azure-storage-blob-connector-troubleshoot/system-topic-managed-identity-type.png" alt-text="Screenshot of Network Security Perimeter rules showing inbound rules for the producer and connector, including Scuba service tag and subscription rule.":::
101
102
102
103
103
104
### Cause 4: The queue message content or Azure Storage Blob data format is invalid
0 commit comments