Daily Defender NewsTwo updated pages deliver concrete administrator guidance: private-endpoint restrictions can block Sentinel data queries through Defender experiences, while the CloudStorageAggregatedEvents table requires subscription-level Defender for Storage V2.
Sentinel · Cloud and workloadsAzure Monitor Private Link Scope supports Sentinel data ingestion into Log Analytics, but it does not support querying through Defender portal experiences or Defender APIs when query access is restricted to private endpoints. Disabling public Log Analytics query access also makes the data unavailable to experiences such as Advanced Hunting.
Defender XDR · Hunting and detectionThe table is populated only when Defender for Storage V2 is enabled at the subscription level. Storage-account-level enablement and the legacy plan are not supported for populating the table.
This period briefing was generated by AI from the tracked Microsoft Learn and Message Center changes.
The documentation now states that the table is populated only when Defender for Storage V2 is enabled at the subscription level. Storage-account-level enablement and the legacy plan are not supported.
The page now explains that Azure Monitor Private Link Scope supports Sentinel data ingestion into Log Analytics, but not querying through Defender portal experiences or Defender APIs when query access is restricted to private endpoints. Disabling public Log Analytics query access makes the data unavailable to experiences such as Advanced Hunting.
