Skip to content

Final steps to complete XDR enrolment

There are two steps to complete for a fully working XDR product, these are:

  1. Activate Defender XDR connector
  2. Activate UEBA

Both these actions can be performed inside the Azure Portal (portal.azure.com).

Activate Defender XDR connector

  1. Open portal.azure.com and navigate to the Microsoft Sentinel product
  2. Click on Data Connectors in the menu
  3. Select the Microsoft Defender XDR connector if this has a grey bar
    1. If it’s green already the connector is already activated
  4. Click in the following screen on Connect incidents & alerts
    A screenshot of a computer
  5. The next message should show in the right top corner:
    A black background with white text
  6. This step is finished, proceed to the next one.

Activate UEBA

  1. Open portal.azure.com and navigate to the Microsoft Sentinel product
  2. Click on Entity Behaviour (under Threat Management)
  3. Click on Set UEBA (if it shows), if not click on Entity behaviour settings
    A screenshot of a computer
  4. Again select Set UEBA
    A close-up of a text
  5. Enable UEBA and check Microsoft Entra ID, then click Apply
    A screenshot of a computer
  6. This final step is finished.