Troubleshoot the Microsoft Graph Logs connector
This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Graph Logs from the Previews page. See Manage Databricks previews.
This page describes common errors you might encounter with the managed Microsoft Graph Logs connector and how to resolve them.
For general troubleshooting guidance that applies to all managed ingestion pipelines, see Troubleshoot managed ingestion pipelines.
Pipeline fails with a 403 Forbidden error
Cause: Microsoft Graph denies access to the security alerts. The application doesn't have the SecurityAlert.Read.All application permission, or admin consent isn't granted. See Microsoft Graph error responses.
Solution:
Confirm that the application has the SecurityAlert.Read.All application permission and that the Status column shows Granted for <your tenant>. See Configure authentication to Microsoft Graph. After you fix the permission, rerun the pipeline.
Pipeline fails to authenticate
Cause: Microsoft Graph rejects the access token after the connector refreshes it and retries. The client secret expired, the credentials on the connection aren't valid, or the Microsoft cloud value doesn't match the tenant.
Solution:
Create a new client secret on the same application, then update the Client Secret on the existing connection. Confirm that the Tenant ID, Client ID, and Microsoft cloud values on the connection match the application. See Configure authentication to Microsoft Graph and Create a Microsoft Graph Logs connection.
Pipeline runs slowly because of throttling
Cause: Microsoft Graph returns 429 Too Many Requests when it throttles the application. See Microsoft Graph throttling guidance.
Solution:
The connector waits for the interval in the Retry-After response header, up to 5 minutes, and then retries the request. If throttling persists, reduce how often the pipeline runs, or reduce other workloads that use the same application.
Microsoft Graph API temporarily unavailable
Cause: Microsoft Graph returned a transient error (HTTP 408, 500, 502, 503, or 504).
Solution:
The connector automatically retries. If the issue persists, wait, then run the pipeline again.