CCF connector creation rejected by new DCR authorization check (Connector creation was rejected by a security requirement...") for all connector kinds, including Content Hub solutions #15338

Describe the bug

Since around early-to-mid October 2026, creating any Microsoft Sentinel data connector that includes a dcrConfig fails with:

Connector creation was rejected by a security requirement that prevents unauthorized use of Azure Monitor data collection rules. Verify that the data collection rule immutable ID and endpoint are correct, the rule sends data to this Log Analytics workspace, and the signed-in user has Microsoft.Insights/dataCollectionRules/write permission on the rule or a parent scope. If the rule was just created or updated, wait two minutes and retry. App-only requests without a delegated user identity are not supported. (Code: BadRequest)

Every condition named in the message is met. This affects Microsoft-published Content Hub solutions as well as custom CCF connectors. Connectors without a dcrConfig (legacy/GenericUI) still deploy normally in the same workspace and session (see Example 1).

To Reproduce

Example 1, Content Hub solution (westus2 workspace, 2026-10-09):

1. Install the TrendAI Vision One solution from Content Hub.
2. Open the Workbench connector page and connect it.
3. The deployment creates the DCR successfully, then the dataConnectors PUT for the Workbench poller fails with the error above. Reproduced 8 times over two hours, with two different users (one Lighthouse-delegated, one from the customer tenant).

Example 2, custom CCF connector (eastus2 workspace, 2026-10-16):

1. Deploy a custom table, a DCE and a DCR (destination: the Sentinel workspace) plus a Customizable connector definition.
2. PUT a dataConnectors resource of kind AmazonWebServicesS3 whose dcrConfig references that DCR's immutable ID and the DCE's logs ingestion endpoint.
3. The PUT fails with the error above.

The same rejection occurs:

• with kinds AmazonWebServicesS3, RestApiPoller and StorageAccountBlobContainer
• when dcrConfig points at a pre-existing, working DCR, including a Sentinel-created one (tag createdBy: Sentinel) that already backs a healthy connector
• with the workspace's Sentinel-managed ASI-workspaceId DCE instead of a dedicated DCE
• with no connectorDefinitionName
• through Azure CLI and the Azure portal (Deploy a custom template, and the Content Hub connector page)
• with API versions 2023-02-01-preview, 2024-01-01-preview, 2024-09-01 and 2025-07-01-preview
• with retries up to 20 minutes after the last DCR change
• for a user delegated through Azure Lighthouse (Contributor) and for a native customer-tenant user holding write and role-assignment rights on the subscription

Expected behavior

The connector is created. That is what happened on 2026-09-02 in the same eastus2 workspace: the same template shape and the same delegated user created an AmazonWebServicesS3 connector with a custom DCR 4 seconds after the DCR was created. A StorageAccountBlobContainer Content Hub connector was also created successfully in that workspace on 2026-10-14. The check appears to have rolled out region by region between those dates (westus2 failing by 2026-10-09, eastus2 after 2026-10-14).

Screenshots

Portal deployment: DCE and DCR operations OK, Microsoft.SecurityInsights/dataConnectors BadRequest with the message above.

Desktop (please complete the following information):

• Azure portal (Edge/Chrome, including an InPrivate session) and Azure CLI on Windows 11

Smartphone (please complete the following information):

• N/A

Additional context

• No documentation for this check was found in What's New, the CCF reference pages or the AWS S3 troubleshooting guide.
• What condition is failing for a DCR and user that meet every criterion in the message? Is this check working as intended for customer-created DCRs and CCF connectors?