We're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion — enabling you to connect and monitor multiple accounts or tenants from a single, unified connector configuration.
The Challenge with Multi-Account Environments
Modern enterprises don't run on a single account. Whether it's multiple Salesforce orgs across business units, several CrowdStrike tenants spanning subsidiaries, or Auth0 environments segmented by product line — security teams have long struggled to get unified visibility across all of them in a single SIEM.
Until now, connecting multiple accounts from the same platform required painful workarounds: duplicate configurations, custom scripts, or dangerous blind spots in security coverage.
Introducing Multi-Account Support for Auth0, CrowdStrike, and Salesforce in Microsoft Sentinel
We're excited to announce that Microsoft Sentinel's data connectors for Auth0, CrowdStrike Falcon, and Salesforce Service Cloud now support multi-account ingestion — powered by the Codeless Connector Framework (CCF). You can now connect and monitor multiple accounts or tenants from a single, unified connector configuration — no scripts, no hacks.
What's New?
🔑 Auth0 — Multi-Tenant Identity Monitoring
Security teams managing multiple Auth0 tenants can now ingest logs from all of them into a single Sentinel workspace. Get complete visibility into authentication events, anomalous login patterns, and policy violations across every tenant without switching contexts.
🦅 CrowdStrike Falcon — Consolidated Endpoint Telemetry
Organizations running multiple CrowdStrike tenants (e.g., across M&A entities or regional subsidiaries) can now stream detection alerts, threat intelligence, and endpoint telemetry from all tenants into Sentinel. One workspace. Full coverage.
☁️ Salesforce — Cross-Org Security Insights
Enterprises with multiple Salesforce orgs can now centralize audit logs, login history, and API activity across all orgs. Detect insider threats, unauthorized access, and compliance gaps without stitching data together manually.
📖Find relevant connectors at Discover connectors
Why It Matters
| Before | After |
| One connector = one account | One connector = multiple accounts |
| Manual workarounds for multi-tenant coverage | Native, built-in multi-account support |
| Fragmented detection across environments | Unified analytics and incident correlation |
| Higher operational overhead | Streamlined configuration and management |
Getting Started
Connecting multiple accounts is straightforward:
1. Navigate to Microsoft Sentinel → Data Connectors
2. Search for Auth0, CrowdStrike Falcon, or Salesforce
3. Open the connector and select "Add Account"
4. Authenticate and authorize each additional account
5. Start ingesting — your analytics rules, workbooks, and playbooks apply automatically across all accounts
Built for Scale, Built for SOC Teams
This update is part of our continued investment in making Microsoft Sentinel the most comprehensive and operationally efficient SIEM for enterprise environments. Multi-account support reduces configuration overhead, closes coverage gaps, and empowers SOC analysts to detect and respond to threats wherever they originate.
What's Next?
We're actively expanding multi-account support to more connectors. Stay tuned to the Microsoft Sentinel Blog and share your feedback!
Microsoft