Issue
After setting up a Microsoft Azure integration, a previously configured Entra ID integration has stopped reporting telemetry in the Red Canary Portal.
Environment
Microsoft Entra ID
Microsoft Azure
Resolution
This is expected behavior when both integrations are exporting data from the same Log Analytics Workspace, to account for duplicated data sets.
Cause
When Entra ID is the only integration configured, a data export is created in Log Analytics Workspace to send data to Red Canary. This data is received under the Entra ID integration.
If an Azure integration is also configured using the same Log Analytics Workspace, a data export is created for this service and the data export for Entra ID is deleted. The data is then received by Red Canary under the Azure integration, and the telemetry volume reported under Entra ID will drop to zero.
Because of the overlap in telemetry Red Canary collects from Entra ID and collects from Azure in the same Log Analytics Workspace, a single data export is used to avoid Microsoft egress charges for redundant data.