Sentinel Workbooks Not Populating Data Despite Connected Status

[satish7098]

Hello Team,

We have added multiple workbooks in Microsoft Sentinel to monitor aggregated security details through a single dashboard. However, the below-listed workbooks are not functioning as expected, and the data is not populating despite the corresponding data connectors being connected and enabled.

We had already submitted a support case with Microsoft, but no resolution was provided.
Tracking ID: 2601070040011416

Affected Workbooks:

Zscaler Private Access (ZPA)
Malware Protection Essentials
Microsoft Cloud App Security – Discovery Logs
Microsoft Copilot for Security Monitoring
Threat Intelligence

We have attached a sample screenshot for reference, which shows that the data sources are enabled; however, the workbook visualizations remain blank with no data displayed.

We would appreciate your assistance in reviewing this issue and advising on the next steps or potential remediation.

Please feel free to reach out to us using the email IDs below if additional information is required:

satish.sadasivan@copeland.com
joseph.ngwatezeh@copeland.com

Let us know if you need any further details from our side.

Thanks,
Satish S

[v-utpalkumar]

Hello @satish7098, thanks for flagging this issue. We will investigate this issue and get back to you with some updates. Thanks!

[v-sabiraj]

Hello @satish7098 , I checked the "Microsoft Copilot For Security Monitoring" workbook, and noticed that almost all queries use "AADNonInteractiveUserSignInLogs". So, even if you have data in "Signinglogs" and "AzureActivity", if there are no logs in "AADNonInteractiveUserSignInLogs", the results will be blank.

Please refer the below images for reference -

Also, if possible can you please add the subscription for the case so that we can check the queries for your workspace.

Additionally, I believe the same issue applies to all the other workbooks mentioned—the logs or events are not available for the selected time range.

Thanks.

[satish7098]

Hello Sabiraj,

Hope you are doing well!!

Thank you for checking this and for confirming that "AADNonInteractiveUserSignInLogs"" currently has no logs.

However, in the affected workbook, the same data type appears to be shown as ""Disconnected"", which is causing some confusion from a visibility standpoint. We wanted to highlight this behavior to understand whether it is expected when no logs are present, or if there is an underlying configuration issue.

Please find the subscription details below for reference:

Subscription: sub-z-cop-sentinel-p-001

Let me know if you need any additional information or validation from my side to proceed further.

Thanks,
Satish S

[v-sabiraj]

Hi @satish7098 , Yes. That is the correct understanding. If the specified table does not have any logs, it will appear greyed out. The tables shown in the workbook template are the required or used tables for that particular workbook. When logs are present, the icon before the table name turns green, and when logs are absent, it appears grey. In this case, since AADNonInteractiveUserSignInLogs does not have any output, it is shown as greyed out.

Please let us know if this resolves your confusion. You can check the workbook once you have data within the specified tables. If you have any additional questions, feel free to ask. Otherwise, we can proceed to close this issue.

[v-kasghosh]

Hey @satish7098 , we’re awaiting your response on this issue. If you’d like to keep it open, please reply within the next couple of days. If we don’t hear back by the specified timeline, we’ll proceed with closing the issue. Thank you!

[satish7098]

Hello Sabiraj,

We can see that logs are successfully flowing into the AADNonInteractiveUserSignInLogs table in Microsoft Sentinel. However, the same data is not being reflected in the Copilot workbook.

Additionally, within the workbook, the AADNonInteractiveUserSignInLogs data type appears as disconnected/greyed out, which is causing confusion since the table does contain data in Sentinel.

Could you please help confirm if there are any additional dependencies or configuration requirements for the Copilot workbook to recognize and display this data?

Let us know if any validation, refresh, or additional logs are required from our side.

Thank you for your support.

Best regards,
Satish S

[v-sabiraj]

Hi @satish7098 , I reviewed it again and found that the table name was incorrect in the Metadata showing table as greyed out though the data was available.
I have fixed it in the PR - https://github.com/Azure/Azure-Sentinel/pull/13595/changes. Once the sync is completed it will be shown correctly.

Regarding the workbook graph rendering issue, I reviewed several queries in the specified workspace and found that the graphs are not appearing because the conditions or filters set in the queries are not being met.

We have below filter in most of the queries -

| where AppDisplayName == "Medeina Portal"

Thanks.

[satish7098]

Hello Sabiraj,

We’ve identified a metadata mismatch between the data type referenced in the Microsoft Copilot for Security Monitoring workbook and the actual log table available in Microsoft Sentinel, which appears to be impacting all queries in the workbook.

Observations:

• In the workbook metadata, the data type is referenced as AADNonInteractiveSignInLogs
• However, there is no corresponding table with this name available in Sentinel
• The actual table ingesting data is AADNonInteractiveUserSignInLogs, as shown in the attached query screenshot

Below is the query where the table name is AADNonInteractiveUserSignInLogs.

Additionally, we noticed that every query in the workbook includes the following filter by default, even though no changes were made on our side and the workbook was deployed directly from the Content Hub:

| where AppDisplayName == "Medeina Portal"

This filter further restricted results and contributed to the confusion, as it does not align with our environment or expected use case.

Clarifications requested:

• Can you please confirm whether there have been any recent metadata or schema changes related to this workbook or data type?
• Is the AADNonInteractiveSignInLogs reference expected to eventually map to an existing Sentinel table via replication or update?
• Should customers expect an updated workbook version from the Content Hub to correct:
  • The table name mismatch
  • The hardcoded AppDisplayName filter

Please let us know if this is a known issue and whether any fixes are already planned, or if we should continue maintaining a customized version of the workbook.

Thanks for your support and clarification.

Best regards,
Satish S

[v-sabiraj]

Hi @satish7098 , The template has been updated, and you can now get version 1.0.2 of the workbook with the corrected table name.

The table names used in the queries are correct, but the display name on the template was incorrect and has now been fixed.

As for the hardcoded AppDisplayName filter, this is expected, as it should only apply to events with this AppDisplayName.

[v-kasghosh]

Hey @satish7098
we’re awaiting your response on this issue. If you’d like to keep it open, please reply within the next couple of days. If we don’t hear back by the specified timeline, we’ll proceed with closing the issue. Thank you!