I have an Azure IoT Hub and I have enabled the defender. I am trying to go to Defender settings and clicking on collection to enable the log analytics storage of the data from the defender and I choose the settings shown below and click save and after a few moments I see the error:
FailedDependency
Unable to enable intelligence pack in Log Analytics workspace '/subscriptions/60660099-64fd-4ca3-a1eb-c9c7f4e6e5f4/resourcegroups/main/providers/microsoft.operationalinsights/workspaces/loganalyticsws'. Please provide below info when asking for support: correlationId = 034d605f-aaf8-4817-91ba-6e57d816a014
I attempted this on a "Free" IoT hub in another tenant and observed the same error. I have tried over two days so don't think it is related to an intermittent issue. This is a screenshot of the page and the error. My Azure IoT Hub is "Standard" billing level for this tenant showing the error here.
To enable Data collection settings in Microsoft Defender for IOT. You need to follow certain pre-requisite according to this MS Document. Your IOT Hub resource should be created in a Standard Tier. It won't work with Free or Basic Tier.
I created one IOT Hub resource in Standard Tier like below:-
Enabled Defender for IoT:-
After Deployment > Went to Defender for IoT > Settings > Data Collection > Enable Microsoft Defender for IoT > Choose the Log Analytics workspace you wish to connect to
Make sure you have created Log Analytics Workspace and Select your subscription and the existing Log analytics workspace or Create a New workspace > Come back to this page > Refresh > and select the Log Analytics Workspace.