One SOC, Many Tenants: Centralizing Microsoft Sentinel with Azure Lighthouse

Hey guys,

The post mentions several times that Microsoft Sentinel is enabled only on the hub workspace, not on the spoke workspaces;for example: "Because Sentinel runs only in the hub, ..."

At the same time, it suggests that cross-workspace detections and analytics rules can be created, stating things like:

• "Cross-tenant detection and hunting can query spoke workspaces without centralizing the underlying source logs."
• "Create a temporary scheduled analytics rule that uses cross-tenant query logic."

Unless I’m missing something, these statements seem contradictory when it comes to analytics rules.

You cannot create a cross-workspace analytics rule that queries workspaces where Microsoft Sentinel is not enabled. If I try to create such a rule against a Log Analytics workspace without Sentinel, the wizard returns the following error:

"The Microsoft Sentinel solution must be deployed on all workspaces in your query."

So while cross-workspace queries work in general, a scheduled analytics rule would require Sentinel to be enabled on every workspace referenced by the query - contrary what this post suggest. Is this going to change by any chance?