Defender for Cloud Apps app connectors: connect Microsoft 365 and fix connector errors

App connectors are the API side of Defender for Cloud Apps: they pull users, activities and files from Microsoft 365, Google Workspace, Salesforce and other services, so policies, anomaly detections and investigations have data to work with. A broken connector shows an error in its dialog and raises a system alert; a misconfigured one simply delivers fewer activities than you expect. In this post I'll decode the documented errors, connect Microsoft 365 properly and show how to prove data is flowing.

Symptoms#

• The connector's status in Settings › Cloud Apps › Connected apps › App Connectors isn't Connected, and the dialog shows one of these errors:

HttpRequestFailure: Server returned: 400 Bad Request: {"error": {"code":"AF20012","message":"Specified tenant ID (...) is incorrectly configured in the system."
Microsoft.Office.Compliance.Audit.DataServiceException: Tenant ... does not exist or {"error":"code":"AF20023","message":"The subscription was disabled."
TokenRefreshException: {"error":"invalid_grant","error_description":"AADSTS70002: Error validating credentials. AADSTS70008: The provided authorization code or refresh token is expired. ...
GoogleJsonResponseException: 401 Unauthorized
GoogleJsonResponseException: 403 Forbidden
TokenResponseException: 400 Bad Request
Get Permissions: NoHttpResponseException: *******.salesforce.com:443 failed to respond
HttpRequestFailure: Server returned: 500 Internal server error

• A system alert reports that a connector failed or disconnected.
• The connector is connected, but the activity log has no Exchange, Teams or Power BI events, no sign-ins, or nothing for some users.

Why it happens#

Missing activities usually have quieter causes: ingestion delays, Exchange mailbox auditing, a scoped deployment that excludes the user, or a provider license (Salesforce activity needs Salesforce Shield; Google Workspace user activity needs a Business or Enterprise edition).

How to fix it#

1. Meet the Microsoft 365 prerequisites#

The tenant needs at least one assigned Microsoft 365 license and auditing turned on in Microsoft Purview. Check auditing in Exchange Online PowerShell:

Connect-ExchangeOnline
Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled
Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true   # only if it returned False
Get-OrganizationConfig | Format-List AuditDisabled               # False = mailbox auditing on by default

Exchange mailbox audit logging must be on for user mailbox activity, and Power BI and Dynamics 365 need auditing enabled in those services; Microsoft expects their logs 24–72 hours after you turn it on. For file monitoring, connect with an account that holds an Entra role such as Application Administrator or Cloud Application Administrator.

2. Connect (or reconnect) Microsoft 365#

1. In the Microsoft Defender portal, go to Settings › Cloud Apps › Connected apps › App Connectors, select +Connect an app, then Microsoft 365.
2. Keep all components selected (they're selected by default) and select Connect. If you configured the connector before January 2026, select all the defaults and connect again, because Microsoft added default components then.
3. On the next page, select Connect Microsoft 365, then Done. The status should change to Connected.
4. For file protection, also turn on Settings › Cloud Apps › Files › Enable file monitoring.

3. Repair non-Microsoft connectors#

• Expired or broken connections: follow the app's connector guide again with the original connection details at hand. For a connector you disabled, Edit settings restarts that flow.
• Google Workspace: connect with a Google Workspace admin, use exactly the scopes from Microsoft's guide, and only choose the unlimited option if the account really is unlimited.
• Salesforce: in Salesforce, go to Setup › Session Settings and clear Lock sessions to the IP address from which they originated.
• IP restrictions: some apps need Defender for Cloud Apps' IP addresses allowed before they accept API calls; Microsoft lists them in its network requirements.
• Transient errors: use Test now, then reconnect if the error returns.

4. Hunt for missing activities#

Work through Microsoft's checklist: the connector is healthy; the activity type is supported for that app and its activity options are enabled; the user isn't excluded by scoped deployment; and you're looking in the right place. Exchange, Power BI and Teams events appear only after activity from those services is detected; sign-ins show only interactive and legacy protocol sign-ins (non-interactive ones are in the Microsoft Entra logs); and policy administration changes are in the Defender for Cloud Apps activity log. After connecting Microsoft 365 you see the past week's data, and the first full scan of a large tenant takes time.

Verify the fix#

• The connector shows Connected and no new connector system alert appears.
• Cloud apps › Activity log, filtered by app and the last day, shows fresh user and admin activities.
• Advanced hunting confirms each app is sending events:

CloudAppEvents
| where Timestamp > ago(1d)
| summarize Events = count(), LastEvent = max(Timestamp) by Application
| order by Events desc

Prevent it next time#

• Connect non-Microsoft apps with an admin account that isn't tied to one person, and watch for it being locked or disabled.
• Route connector system alerts to a monitored mailbox or queue.
• Keep Microsoft 365 auditing on; see Audit in Purview.
• Connectors feed the rest of Defender for Cloud Apps, from shadow IT discovery to session policies.

References#

• Troubleshoot app connector errors
• Protect your Microsoft 365 environment
• Connect apps with API connectors in Defender for Cloud Apps