Update Data Connectors failed

[shaileshnamjoshi]

I am trying to connect OCI Data Connector ,
From OCI Side Stream service is up and running,

Below is the error message from Activity Log in Azure

{
"authorization": {
"action": "Microsoft.SecurityInsights/dataConnectors/write",
"scope": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2"
},
"caller": "shaileshdenmark96@gmail.com",
"channels": "Operation",
"claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/32f981af-01ba-4b2a-b438-0fde8a696314/",
"iat": "1768507715",
"nbf": "1768507715",
"exp": "1768513177",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AeQAG/8bAAAAtAHG0JX8zo+sHsSDYdFhAcPRdwTTLBA+fam4zhajFCLNBYv1rzhwClF7uh7NNdFbUr4qqggu+sPYizgiroezlAOTKJfOh2k1mierMJtJ/EjxRXxrgU9/SCl+Q+cBUElaNmfzFm+XKuqMCMNxmi4GVv+5L5ECXNzNFNUNS7BAF8/gHfH0oVO8dFrpPTPrJuXahS4EB7CnpdxdFSgdv15eF9ePNN6H/cgcwvSMrl94cuUPFOtF+nLZaHKV/wiVhE6JK2eqEhgl4LMichYPdOUzkR/6TB+HnEa8+AW0432N1AE=",
"altsecid": "1:live.com:00034001435D9093",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "shaileshdenmark96@gmail.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Namjoshi",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Shailesh",
"groups": "6433091f-6f95-4904-aad3-87df2aaa8f86",
"http://schemas.microsoft.com/identity/claims/identityprovider": "live.com",
"idtyp": "user",
"ipaddr": "87.59.192.216",
"name": "Shailesh Namjoshi",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "11c52f16-ccbb-47ad-8f9f-01744fdf13b4",
"puid": "10032001F7284E86",
"rh": "1.AXkAr4H5MroBKku0OA_eimljFEZIf3kAutdPukPawfj2MBMMASN5AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0011941a-2254-4831-b832-752344675cb4",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "_e7fr-XA1StrX93637AlU-P0YcIHkdDk0sxEHY9smuo",
"http://schemas.microsoft.com/identity/claims/tenantid": "32f981af-01ba-4b2a-b438-0fde8a696314",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "live.com#shaileshdenmark96@gmail.com",
"uti": "nbXpW50Nv0O1znuwkzM1AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10",
"xms_act_fct": "3 5",
"xms_edov": "true",
"xms_ftd": "tHbqdCue1qatdJBFPtTdVRPoavDI6mqAhpeL0D1OzicBZXVyb3Blbm9ydGgtZHNtcw",
"xms_idrel": "1 6",
"xms_sub_fct": "3 12",
"xms_tcdt": "1651753978"
},
"correlationId": "62b01035-a118-44cd-b86b-7cc881bc6133",
"description": "",
"eventDataId": "aad93ca3-a076-49a9-aa4e-626e7ac7d61b",
"eventName": {
"value": "EndRequest",
"localizedValue": "End request"
},
"category": {
"value": "Administrative",
"localizedValue": "Administrative"
},
"eventTimestamp": "2026-01-15T20:21:12.3294438Z",
"id": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2/events/aad93ca3-a076-49a9-aa4e-626e7ac7d61b/ticks/639041052723294438",
"level": "Error",
"operationId": "0b933326-35e1-44df-87c9-52fda921c3a9",
"operationName": {
"value": "Microsoft.SecurityInsights/dataConnectors/write",
"localizedValue": "Update Data Connectors"
},
"resourceGroupName": "rg-sentinel",
"resourceProviderName": {
"value": "Microsoft.SecurityInsights",
"localizedValue": "Microsoft.SecurityInsights"
},
"resourceType": {
"value": "Microsoft.SecurityInsights/dataConnectors",
"localizedValue": "Microsoft.SecurityInsights/dataConnectors"
},
"resourceId": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2",
"status": {
"value": "Failed",
"localizedValue": "Failed"
},
"subStatus": {
"value": "BadRequest",
"localizedValue": "Bad Request (HTTP Status Code: 400)"
},
"submissionTimestamp": "2026-01-15T20:23:17Z",
"subscriptionId": "e74d718a-2104-4fc3-8f9a-563d679d8f31",
"tenantId": "32f981af-01ba-4b2a-b438-0fde8a696314",
"properties": {
"statusCode": "BadRequest",
"serviceRequestId": null,
"statusMessage": "{"error":{"code":"BadRequest","message":"Connectivity check failed. ConnectorId: oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2, Status code:OCI40003, Message:Cursor Creation Failed due to Invalid PassPhrase."}}",
"eventCategory": "Administrative",
"entity": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2",
"message": "Microsoft.SecurityInsights/dataConnectors/write",
"hierarchy": "32f981af-01ba-4b2a-b438-0fde8a696314/e74d718a-2104-4fc3-8f9a-563d679d8f31"
},
"relatedEvents": []
}

/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2
Operation name
Update Data Connectors
Time stamp
Thu Jan 15 2026 21:21:12 GMT+0100 (Central European Standard Time)
Event initiated by
shaileshdenmark96@gmail.com
Error code
BadRequest
Message
Connectivity check failed. ConnectorId: oracle-cloud-infra-connector9a2344c7-8973-4c04-80cf-4fadee20bfa2, Status code:OCI40003, Message:Cursor Creation Failed due to Invalid PassPhrase.

PassPhrase : Kept blank as it is optional

[shaileshnamjoshi]

@v-kasghosh @v-utpalkumar could you please let me know what is the error from Microsoft side or Oracle cloud Infrastructure side? we will debug together if needed.

[shaileshtelenor]

@v-kasghosh @v-utpalkumar Looks like the issue is with the connector as we could be able to connect it with Azure Functions which we used when Azure Functions was not deprecated in the Sentinel for OCI.

please let me know,

[shaileshnamjoshi]

@hassanchawiche @v-utpalkumar @v-kasghosh We have new error ,

{
"authorization": {
"action": "Microsoft.SecurityInsights/dataConnectors/write",
"scope": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connectoredb2453a-5a4c-4ed3-b0b3-72ba131e68ed"
},
"caller": "shaileshdenmark96@gmail.com",
"channels": "Operation",
"claims": {
"aud": "https://management.core.windows.net/",
"iss": "https://sts.windows.net/32f981af-01ba-4b2a-b438-0fde8a696314/",
"iat": "1768909238",
"nbf": "1768909238",
"exp": "1768914662",
"http://schemas.microsoft.com/claims/authnclassreference": "1",
"acrs": "p1",
"aio": "AeQAG/8bAAAAGYUX8TCh8z0GqYQlrEhwlP9XPg08qBw8cV1ynavOy/9F3y46KL7+1jnuuSXWtK4jqW9rPLZV+f2/2qek6kQeYY1dxtjXuRAoeVfGbMhD2SQ9nDWg1q9NUaE1jerN9u2U8zjSTaLG0BoMsOM/F1OGLK4k7l/v+SySOSJfheeH6v0PHocavx9kalHDaxld9qUVdjlKgqK0/ktU7HdSnIXsX0zGrYwVwHJSfDM/DuaUPWWHHGog/vbTV2welR9W/wNKaTk4N2B985NHxxhR6Y32T78Obi276kSxS9BD4lqXDEM=",
"altsecid": "1:live.com:00034001435D9093",
"http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
"appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
"appidacr": "0",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "shaileshdenmark96@gmail.com",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Namjoshi",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Shailesh",
"groups": "6433091f-6f95-4904-aad3-87df2aaa8f86",
"http://schemas.microsoft.com/identity/claims/identityprovider": "live.com",
"idtyp": "user",
"ipaddr": "192.33.243.69",
"name": "Shailesh Namjoshi",
"http://schemas.microsoft.com/identity/claims/objectidentifier": "11c52f16-ccbb-47ad-8f9f-01744fdf13b4",
"puid": "10032001F7284E86",
"rh": "1.AXkAr4H5MroBKku0OA_eimljFEZIf3kAutdPukPawfj2MBMMASN5AA.",
"http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
"sid": "0011941a-2254-4831-b832-752344675cb4",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "_e7fr-XA1StrX93637AlU-P0YcIHkdDk0sxEHY9smuo",
"http://schemas.microsoft.com/identity/claims/tenantid": "32f981af-01ba-4b2a-b438-0fde8a696314",
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "live.com#shaileshdenmark96@gmail.com",
"uti": "NJcqnfuyFEWXUmbkPE48AA",
"ver": "1.0",
"wids": "62e90394-69f5-4237-9190-012177145e10",
"xms_act_fct": "5 3",
"xms_edov": "true",
"xms_ftd": "SPTDp7HOoi809WANOOxFkN36quA-LPbDLJh2k_WkLRQBZXVyb3Bld2VzdC1kc21z",
"xms_idrel": "18 1",
"xms_sub_fct": "4 3",
"xms_tcdt": "1651753978"
},
"correlationId": "59fc29ca-01e0-4de8-98f3-8c845cdc7071",
"description": "",
"eventDataId": "7c1964ff-c76f-44f3-97f7-d4f34639fb99",
"eventName": {
"value": "EndRequest",
"localizedValue": "End request"
},
"category": {
"value": "Administrative",
"localizedValue": "Administrative"
},
"eventTimestamp": "2026-01-20T12:43:25.0963114Z",
"id": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connectoredb2453a-5a4c-4ed3-b0b3-72ba131e68ed/events/7c1964ff-c76f-44f3-97f7-d4f34639fb99/ticks/639045098050963114",
"level": "Error",
"operationId": "12cfb7aa-bc88-4d11-bb93-5d904244c4ca",
"operationName": {
"value": "Microsoft.SecurityInsights/dataConnectors/write",
"localizedValue": "Update Data Connectors"
},
"resourceGroupName": "rg-sentinel",
"resourceProviderName": {
"value": "Microsoft.SecurityInsights",
"localizedValue": "Microsoft.SecurityInsights"
},
"resourceType": {
"value": "Microsoft.SecurityInsights/dataConnectors",
"localizedValue": "Microsoft.SecurityInsights/dataConnectors"
},
"resourceId": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connectoredb2453a-5a4c-4ed3-b0b3-72ba131e68ed",
"status": {
"value": "Failed",
"localizedValue": "Failed"
},
"subStatus": {
"value": "BadRequest",
"localizedValue": "Bad Request (HTTP Status Code: 400)"
},
"submissionTimestamp": "2026-01-20T12:48:27Z",
"subscriptionId": "e74d718a-2104-4fc3-8f9a-563d679d8f31",
"tenantId": "32f981af-01ba-4b2a-b438-0fde8a696314",
"properties": {
"statusCode": "BadRequest",
"serviceRequestId": null,
"statusMessage": "{"error":{"code":"BadRequest","message":"Connectivity check failed. ConnectorId: oracle-cloud-infra-connectoredb2453a-5a4c-4ed3-b0b3-72ba131e68ed, Status code:OCI40005, Message:An unknown OCI exception occurred. OciException status code: BadRequest"}}",
"eventCategory": "Administrative",
"entity": "/subscriptions/e74d718a-2104-4fc3-8f9a-563d679d8f31/resourcegroups/rg-sentinel/providers/Microsoft.OperationalInsights/workspaces/sentinel-workspace/providers/Microsoft.SecurityInsights/dataConnectors/oracle-cloud-infra-connectoredb2453a-5a4c-4ed3-b0b3-72ba131e68ed",
"message": "Microsoft.SecurityInsights/dataConnectors/write",
"hierarchy": "32f981af-01ba-4b2a-b438-0fde8a696314/e74d718a-2104-4fc3-8f9a-563d679d8f31"
},
"relatedEvents": []
}

I have added passphrase and it is still showing me the same,

[shaileshtelenor]

@hassanchawiche @v-utpalkumar @v-kasghosh This is critical for one of the customer could you please let me know what could be the resolution on Sentinel for this connector? Have you been able to trace the log? could we do it together?