Is Microsoft Sentinel experiencing major ingestion delays in UK South?
Asked by
MellowPine47
Since around 12:00 UTC today, data has been arriving very late in a Microsoft Sentinel workspace hosted in UK South. Nothing appears to be failing outright, but checking with `ingestion_time()` instead of `TimeGenerated` shows roughly 160 minutes of average delay, with the worst cases reaching about 183 minutes. Ingestion then stopped for around an hour, briefly resumed for some tables, and stalled again. The issue appears to affect all tables, with no recent configuration changes and no obvious problems reported in the workspace health checks. Is anyone else seeing similar Sentinel or AMA ingestion delays?
Answers
The `ingestion_time()` versus `TimeGenerated` comparison is the right way to confirm whether this is latency rather than data loss. The Workspace Usage Report may help identify whether one connector or data type is backing up, although reports of every table being affected point more toward a broader service-side issue.
Reply to this answer
We’re seeing the same thing in UK South. Sentinel ingestion has been delayed since roughly 15:30, but Microsoft indicated that the data hasn’t been lost and should catch up overnight.
Reply to this answer
This doesn’t seem isolated to one workspace. Other administrators are reporting ingestion problems across multiple customers, including delays involving AMA-based collection. XDR data is also arriving several hours late in some cases.
Reply to this answer
I’ve had heartbeat alerts fail across three separate tenants at different times today. They’re still failing, even though nothing obvious is showing in the Azure status information.
Reply to this answer
Add your answer
Answers are reviewed before publication.
MellowPine47: It’s affecting all tables in this workspace, not just one connector. I’ve raised it with Microsoft and will share an update when they provide more information.