So we have successfully onboarded our Sentinel to Defender.
It states its connected but every click in the portal like "search", "tables", "Data connectors" etc leads us to "Settings > Microsoft Sentinel" and the "SIEM workspaces".

Its been over 24h, from what i can tell all XDR is configured correctly, even tried a admin role that grants it all along with all workspaces etc. Global admin role is being used, owner on the subscription where Sentinel resides but still the defender integration does not seem to work.

From the Azure sentinel perspective XDR seems onboarded, UEBA configured etc.. Any advice?

Hi
We setup a new sentinel instance and connected entra id, everything looks good, diagnostic settings are created and such but no logs stream to the workspace.

tried recreating the diag. setting but its still not streaming.

There is no limit right on how many workspaces you can stream to right? We have another test sentinel streaming logs but its another workspace and both should be able to get it right?