Share via

Unable to connect Microsoft Sentinel workspace to Defender portal as Primary workspace

נדב שלום 0 Reputation points
2026-05-18T06:26:07.0633333+00:00

Hello,

We are unable to connect a Microsoft Sentinel workspace to the Microsoft Defender portal and set it as the Primary workspace.

Error shown in Microsoft Defender portal:

"Failed to connect primary workspace"

"Couldn't connect <workspace-name>. A connected primary is required."

This does not appear to be a permissions issue or a Data Connector issue.

Environment:

  • Microsoft Sentinel workspace exists and is active.
  • The workspace appears in Azure Portal and Microsoft Sentinel.
  • The Microsoft Sentinel solution is provisioned successfully: SecurityInsights(<workspace-name>), provisioningState: Succeeded.
  • The Azure subscription is Enabled.
  • The user performing the action is Subscription Owner and Global Administrator.
  • Required Azure Resource Providers are Registered:
    • Microsoft.SecurityInsights
    • Microsoft.OperationalInsights
    • Microsoft.Security
    • Microsoft.Insights
    • Microsoft.AlertsManagement

What we already tried:

  • Verified the correct tenant and subscription.
  • Verified the user has Owner permissions on the subscription.
  • Verified Microsoft Sentinel solution provisioning state is Succeeded.
  • Verified all required resource providers are Registered.
  • Tried connecting the workspace from Microsoft Defender portal: System > Settings > Microsoft Sentinel > Workspaces.
  • Tried using an InPrivate browser session.

Additional symptom:

In Azure Portal, when opening Microsoft Sentinel > Content hub, the page says that it was moved to Defender portal and asks to connect the workspace to the Defender portal.

I still cannot connect the workspace as primary to the Microsoft Defender

Thank you.

Microsoft Security | Microsoft Sentinel

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. נדב שלום 0 Reputation points
    2026-05-18T06:36:03.22+00:00

    Update:

    We also verified that there is only one Microsoft Sentinel-enabled workspace in the environment.

    Command result:

    SecurityInsights(<workspace-name>) <resource-group> israelcentral

    We also explicitly assigned Microsoft Sentinel Contributor to the same user at the Log Analytics workspace scope.

    Current state:

    • Only one Sentinel-enabled workspace exists.
    • The Sentinel solution provisioningState is Succeeded.
    • The subscription is Enabled.
    • Required Azure Resource Providers are Registered.
    • The user is Subscription Owner.
    • The user is Global Administrator.
    • The user is Microsoft Sentinel Contributor on the workspace.

    After RBAC propagation, we will retry from an InPrivate session.

    If the same error remains:

    "Failed to connect primary workspace"

    "Couldn't connect <workspace-name>. A connected primary is required."

    then this appears to be a Defender portal / Unified SecOps onboarding state issue, not a permissions or multi-workspace issue.

    Is there any way to reset the Sentinel-to-Defender workspace binding from the backend, or any diagnostic command/API that shows the onboarding state?

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-05-18T06:26:36.45+00:00

    To connect a Microsoft Sentinel workspace to the Microsoft Defender portal and set it as the primary workspace, the environment must meet the documented prerequisites and role requirements, and the connection must be initiated from the Defender portal.

    Based on the described environment and attempts, verify and perform the following in order:

    1. Confirm Sentinel is correctly enabled on the workspace
      • Ensure the workspace is a Log Analytics workspace with Microsoft Sentinel enabled (SecurityInsights provisioningState: Succeeded), which is already stated as done.
    2. Verify tenant and workspace model requirements
      • The Microsoft Defender portal supports a single Microsoft Entra tenant and a connection to one primary workspace plus multiple secondary workspaces. If there is only one Sentinel-enabled workspace when onboarding, that workspace becomes the primary by default.
      • If there is more than one Sentinel-enabled workspace in the tenant, the additional role requirement applies (see step 3).
    3. Verify all required roles for connecting and setting a primary workspace For onboarding and primary workspace operations, the following roles are required simultaneously:
      • To onboard Microsoft Sentinel to the Defender portal (connect the first workspace):
        • Owner or User Access Administrator on the subscription, and
        • Microsoft Sentinel Contributor at subscription, resource group, or workspace scope.
        • If the tenant has more than one Sentinel-enabled workspace, the user must also be at least a Security administrator in Microsoft Entra ID.
      • To change or set the primary workspace:
        • Security administrator (or higher) in Microsoft Entra ID, and
        • Owner or User Access Administrator on the subscription, and
        • Microsoft Sentinel Contributor at subscription, resource group, or workspace scope.
      Ensure that, in addition to being Subscription Owner and Global Administrator, the account has:
      • Microsoft Sentinel Contributor on the relevant scope, and
      • Security administrator (or higher) in Microsoft Entra ID if there is more than one Sentinel-enabled workspace.
    4. Onboard the workspace from the Defender portal
      • In the Microsoft Defender portal (https://security.microsoft.com/):
        1. Go to System > Settings > Microsoft Sentinel > Connect a workspace.
        2. Select the Sentinel-enabled workspace and select Next.
        3. Select the Primary workspace.
        4. Review the product changes and select Connect.
      • After successful connection, the Home page in the Defender portal shows Microsoft Sentinel metrics (data connectors, automation rules, etc.).
    5. If a primary workspace already exists
      • The error message indicating that “A connected primary is required” can occur when trying to connect or promote another workspace while the portal expects an already connected primary.
      • If another workspace is currently primary, change the primary workspace:
        1. In the Defender portal, go to System > Settings > Microsoft Sentinel > Workspaces.
        2. Select the workspace that should become primary.
        3. Select Set as primary.
        4. Review the product changes and select Confirm and proceed.
      • When the primary workspace is changed, the Defender XDR connector is automatically connected to the new primary and disconnected from the former one.
    6. If the workspace was previously connected and needs to be reconnected
      • If the workspace was connected and then offboarded, reconnect it:
        1. In the Defender portal, go to System > Settings > Microsoft Sentinel.
        2. On the Workspaces page, select the workspace and choose Connect a workspace.
      • Note that offboarding a workspace that has the Microsoft Defender XDR connector configured also disconnects that connector; reconnecting restores the integration.
    7. Validate access to Sentinel data once connected
      • To query Sentinel data and view incidents in the Defender portal, ensure the account has at least Microsoft Sentinel Reader or a role with the documented read/query actions.
      • For advanced hunting across Sentinel and Defender XDR data, ensure the account has Microsoft Sentinel Reader and that the workspace is connected via the “Connect a workspace” option in advanced hunting.

    If all role prerequisites (including Microsoft Sentinel Contributor and Security administrator where required) are satisfied and the workspace is onboarded through System > Settings > Microsoft Sentinel > Connect a workspace, the workspace can be set as primary using the documented steps.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.