Datalake in Sentinel is not working properly since completing this course: TechWorkshop L300: Understanding Sentinel data lake and graph

Question

Datalake in Sentinel is not working properly since completing this course: TechWorkshop L300: Understanding Sentinel data lake and graph

System Administrator 0

Datalake in Sentinel is not working properly since completing this course: TechWorkshop L300: Understanding Sentinel data lake and graph in Microsoft. I have no access to Datalake tables or Datalake features since completing this course.

Part of the training was to configure Sentinel Datalake but then go on to turn off datalake and delete all resource groups attached as per course instructions. My datalake has not worked properly since. I configured a new datalake in sentinel, i can see the tables but can't see or configure them or query the datalake ? I have a screenshot where I believe the issue to be which I can provide .Can this be deleted in the backend as I think this is causing my current issue ?

There is an issue I feel in the backend of Sentinel that I have no access to T/ Shoot. This is why I really need a support ticket opened to look into this. I can provide more details when this is opened.

I was redirected here when I tried to open support ticket

Thank you

Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-04-27T03:21:31.9433333+00:00
Hey there! It sounds like after you followed the TechWorkshop L300 lab steps—turning off your Sentinel Data Lake and deleting its resource groups—your new lake isn’t fully “speaking” to Sentinel anymore. You can see the tables, but you can’t query or configure them. Let’s walk through the most common causes and what you can try next:

Wait for table provisioning

New Data Lake databases and tables can take a few minutes (sometimes up to a couple of hours) to finish provisioning.

If you hit an error like “ProvisioningIncomplete” or “DeltaTableMissing,” just give it some time and retry your query.

Check your permissions

You need proper RBAC both on the Log Analytics workspace and on the underlying storage/Synapse resource.

Common errors in notebooks or queries include MissingSASToken, InvalidSASToken, TokenExpired or TableInsufficientPermissions.

Make sure your user is at least a Contributor (or higher) on the storage account and Workspace Owner (or Log Analytics Contributor) on the workspace.

After any RBAC change, restart your browser session or close/reopen the Sentinel notebook.

Re-verify your Data Lake setup in Sentinel

In the Azure portal: Microsoft Sentinel > Settings (or Defender portal > Data export) > Data Lake configuration.

Ensure the correct storage account, resource group and Log Analytics workspace are selected. If the old resource group was deleted, you may need to “unlink” the old settings and point Sentinel to your new lake.

Look for JSON/schema or ingestion errors

If you see errors like JsonParsingFailure (2302) or TableSchemaMismatch (2401), there may be a corrupted table definition or schema drift.

Follow the guidance in the “Run notebooks on the Microsoft Sentinel data lake” troubleshooting table to align schema, fix column names/types, or contact support with your tenant ID, table name and database name.

If you still can’t query after those steps, could you share:

The exact error message or error code you see when running a query or notebook cell?

Are you using the Logs blade, a Synapse notebook or the built-in Sentinel notebook experience?

Which Log Analytics workspace and Data Lake resource names you’re trying to hit?

Reference docs for troubleshooting your Sentinel Data Lake:

https://learn.microsoft.com/azure/sentinel/datalake/notebooks?wt.mc_id=knowledgesearch_inproduct_azure-cxp-community-insider#troubleshooting

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-04-28T01:55:07.2233333+00:00

System Administrator Following up to see if the above provided information was helpful. If you have any further queries do let us know.

1 answer

Your answer

Rukmini 39,110 Reputation points Microsoft External Staff Moderator

2026-04-28T01:55:07.2233333+00:00

System Administrator Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Answer 1

Hello,

Go to Microsoft Defender portal > System > Settings > Microsoft Sentinel > Data lake and confirm the data lake onboarding is complete. Microsoft notes that onboarding can take up to 60 minutes, and newly enabled or moved tables can take 90–120 minutes before data is available.

Confirm you have the right permissions. For data lake read/query access, Microsoft Sentinel supports Microsoft Entra roles such as Security Reader / Security Operator / Security Administrator, or workspace-level Azure RBAC roles such as Log Analytics Reader, Microsoft Sentinel Reader, Microsoft Sentinel Contributor, etc.

For table management, viewing table settings requires permissions such as Security data basics (read) or Microsoft.OperationalInsights/workspaces/tables/read. Configuring table settings requires Data (manage) or Log Analytics write/table write permissions, such as those provided by Log Analytics Contributor.

In Data lake exploration > KQL queries, check the Selected workspaces dropdown. If a workspace is empty or still onboarding, the schema browser may not show tables

Share via

Datalake in Sentinel is not working properly since completing this course: TechWorkshop L300: Understanding Sentinel data lake and graph

1 answer

Your answer