Skip to content

Troubleshooting

Last updated View as MarkdownAgent setup

Use this guide to resolve common issues when integrating Cloudflare logs with Microsoft Sentinel through the Codeless Connector Framework (CCF).

Connector deployment fails with InternalServerError (HTTP 500)

Cause: The Microsoft-managed service principal required by the Cloudflare CCF connector has not been provisioned in your Microsoft Entra ID tenant. This typically happens when the Grant tenant-wide admin consent button on the connector configuration page cannot complete the OAuth redirect — for example, due to browser extensions, a cached session, a conflicting signed-in account, a Conditional Access policy, or an unmet Multi-Factor Authentication (MFA) challenge.

Fix:

  1. Confirm that the Microsoft.SecurityInsights resource provider is registered on your subscription:

    az provider show --namespace Microsoft.SecurityInsights --query "{state:registrationState}"

    The output should return "state": "Registered".

  2. In an InPrivate/Incognito browser session, sign in as a user holding one of the following Microsoft Entra roles: Privileged Role Administrator, Cloud Application Administrator, AI Administrator, or Application Administrator.

  3. Open the direct tenant-wide admin consent URL for the Microsoft-managed application (App ID 4f05ce56-95b6-4612-9d98-a45c8cc33f9f), replacing {tenant-id} with your Entra tenant ID:

    https://login.microsoftonline.com/{tenant-id}/adminconsent?client_id=4f05ce56-95b6-4612-9d98-a45c8cc33f9f

  4. Complete the consent flow, including any MFA challenge.

Verify: Refresh the Cloudflare connector configuration page in Microsoft Sentinel. The Service Principal ID field should populate automatically, and the Grant tenant-wide admin consent button should no longer be displayed. Retry the connector deployment.

Deployment fails with InvalidTemplate on CreateDataFlowResources

You see a deployment failure with an error similar to:

Deployment template validation failed: 'The resource
'Microsoft.Resources/deployments/CreateDataFlowResources'
is not defined in the template.'

Cause: The ARM template requires the Azure Blob Storage account and the Microsoft Sentinel workspace (and its underlying Log Analytics workspace) to reside in the same Azure subscription and the same resource group. When they are in different subscriptions or different resource groups, the nested CreateDataFlowResources sub-deployment cannot resolve the required resource references and validation fails.

A less common variant of this error occurs when the Microsoft.EventGrid resource provider is not registered in the target subscription.

Fix:

  1. Confirm that both resources are co-located in the same Azure subscription and the same resource group. If they are not, redeploy or migrate them so they share both.

  2. Register the required resource providers on the target subscription:

    az provider register --namespace Microsoft.SecurityInsights
az provider register --namespace Microsoft.EventGrid

  3. After deployment, confirm that the Microsoft-managed service principal holds the following role assignments on the Storage account:

    • Storage Blob Data Reader
    • Storage Queue Data Contributor

  4. Confirm that the Storage account's networking configuration allows the connector to access the Azure Storage Queue.

Verify: Redeploy the connector. The Deployments blade should show status Succeeded, and the connector should transition to Connected.

Connector update fails with Invalid output table schema

You see a deployment failure with an error similar to:

Failed to create required resources for data connector.
Invalid output table schema: The following columns which exist
in the current schema do not exist in the new schema or have
different types.

Cause: An earlier version of the Cloudflare CCF connector created a CloudflareV2_CL table in your Log Analytics workspace. When you deploy a newer connector version, the ARM template attempts to update this table schema. Azure Monitor rejects the update if the new schema omits columns that exist in the current table, or changes an existing column to an incompatible datatype.

Fix: Update the existing table schema directly through the Azure Monitor REST API before redeploying the connector. Run the update from Azure Cloud Shell using an account that holds the Log Analytics Contributor role on the workspace.

  1. Download the latest CloudflareV2_CL.json schema definition from the Cloudflare CCF connector solution package (available in the Microsoft Sentinel Content Hub ↗) and upload it to your Cloud Shell session.

  2. Request an Azure Resource Manager access token:

    az account get-access-token --resource https://management.azure.com/

  3. Apply the updated table schema, replacing the placeholders with your values:

    az rest --method PUT \
  --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.OperationalInsights/workspaces/<workspace-name>/tables/CloudflareV2_CL?api-version=2025-07-01" \
  --headers "Authorization=Bearer <access-token>" "Content-Type=application/json" \
  --body @CloudflareV2_CL.json

Verify: The command returns the updated table definition as JSON. Redeploy the Cloudflare CCF connector — the deployment should complete without a schema validation error.

Fields are missing or null in CloudflareV2_CL

Cause: The Data Collection Rule (DCR) schema is out of sync with the Cloudflare Logpush schema being delivered. Two variants are common:

  • Datatype mismatch: A field is declared with the wrong Sentinel datatype in the DCR streamDeclarations — for example, a numeric field declared as string. The record is ingested, but the mismatched column is populated with null.
  • Reserved column name conflict: A Cloudflare field name collides with a Microsoft Sentinel reserved column name ↗. For example, the Cloudflare Network Error Logging (NEL) dataset contains a Type field, but Type is reserved in Sentinel. Fields with reserved names cannot be stored under their original name.

Fix:

  • For datatype mismatches: Update the field's datatype in both the DCR streamDeclarations and the CloudflareV2_CL table definition to match the Cloudflare Logpush schema (for example, real for floating-point values such as EdgeResponseCompressionRatio).

  • For reserved name conflicts: Rename the field in the DCR transformKql transformation and add the renamed column to the CloudflareV2_CL table definition. For example, to preserve the NEL Type value:

    source
| extend NELType = Type
| project-away Type

    Add a NELType column to CloudflareV2_CL with datatype string.

Verify: Send a fresh Logpush batch and query CloudflareV2_CL for the affected fields. Values should now be populated and no longer null.

Still not resolved?

If your issue is not covered above:

Was this helpful?