Multi-workspace for Multi-tenant is now in Public Preview in Microsoft's Unified SecOps Platform

We are thrilled to announce that our unified security operations (SecOps) platform now supports multi workspaces for multiple tenants, currently available in public preview. This marks a significant advancement in our commitment to providing comprehensive security solutions tailored to the diverse needs of our customers. The unified platform integrates the capabilities of Microsoft Sentinel, Defender XDR, and more, offering a seamless and robust experience. 

What's Included in the Microsoft Unified Security Operations Platform? 

The unified SecOps platform integrates several advanced features designed to provide comprehensive security management across multiple workspaces and tenants:

• Single pane of glass for all your tenant’s incidents and alerts. Triage and investigate incidents and alerts across multiple workspaces and tenants in a single place.
• Improved threat hunting experience. Proactively search for security data across multiple workspaces and tenants using Advanced hunting.

Multi-workspace, Multi-tenant Experience—Main Scenarios

Multi-tenant portal

To use the unified SecOps platform experience for multiple tenants and workspaces, you must first sign in to the multi-tenant portal.

Learn more: https://aka.ms/mtoportal

Make sure to onboard all your tenants’ workspaces separately in the main, single tenant portal. Workspaces are onboarded separately for each tenant. (each tenant is onboarded separately).  

Learn more: https://aka.ms/OnboardMultiWS

Incidents and Alerts 

In the unified queues, you are now able to view all incidents and alerts, from all workloads, workspaces, and tenants, and filter by workspace or tenant. Each alert and incident is related to a single workspace and tenant to keep data boundaries. Bi-directional sync ensures that any change made in the unified SecOps portal is reflected in Microsoft Sentinel in the Azure portal, and vice versa. 

Advanced Hunting

In Advanced Hunting, you'll be able to explore all your security data in a single place. For hunting and investigation purposes, you'll be able to query Microsoft Sentinel with data from all your workspaces, running queries across multiple workspaces and tenants using the workspace operator in your query.

Instructions

• Navigate to Advanced Hunting in MTO portal.
• Select tenants and workspace in the selector: Click on the tenant selector in the right section of the window. For each tenant with workspace onboarded, click on “edit selection” and choose the workspace (we currently support only single WS selection per tenant).

• Run any cross-tenant queries with a single workspace in each tenant (all queries can be joined with Defender tables).
• Quering across multiple workspaces and multiple tenants using the “workspace operator”:
  • You can run queries across multiple workspaces and multiple tenants.
  • To do so, please select only a single tenant in the selector and use the workspace operator by calling other workspaces’ names.
  • For example:
    • You manage two tenants, with multiple workspaces for each tenant: TenantA: WS1, WS2; TenantB: WS3, WS4.
    • You would like to run cross WS-cross tenants queries.
    • You should: 
      • select any tenant in the selector (should be single select: TenantA, and WS1 selected).
      • Run cross queries on “Usage” table.
      • Query:
        

        union workspace("WorkspaceB2").Usage, Usage
        | where TimeGenerated > ago(1d)
        | summarize TotalRecords = count() by Workspace = TenantId 

      • Results: you should receive results from WS1 (TenantA) and results from WS3 (TenantB).
  • This capability is available only for tenants that have permissions to other tenants’ workspaces using Azure Lighthouse. 

FAQ

• How can I onboard my tenants’ workspaces to the unified SecOps platform?
  • Onboard each tenants’ workspaces separately in the single tenant portal. Learn more: https://aka.ms/OnboardMultiWS
•  Is Azure Lighthouse supported in the MTO portal?
  • Yes, Azure Lighthouse is supported and required to gain access to Microsoft Sentinel data in other tenants’ workspaces.
• What delegated access method is supported in the MTO portal?
  • To use the multi workspace capability you must enable:
    • Azure Lighthouse - required to access other tenants’ Microsoft Sentinel data.
    • B2B - to access Defender data.
  • GDAP is not supported yet for unified SecOps capabilities.
• Will data from one workspace/ one tenant be synced to a second workspace/ tenant?
  • No, data boundaries between workspaces and tenants are maintained, ensuring that each workspace will only be synced with its own data.
• Can I still access my environment in Azure?
  • Yes, all experiences remain the same.

Conclusion

Microsoft’s unified SecOps platform support for multi- workspace, multi- tenants customers represent a significant leap forward in cybersecurity management. By centralizing operations and providing robust tools for detection, investigation, and automation, it empowers organizations to maintain a vigilant and responsive security posture. The platform’s flexibility and comprehensive view of security data make it an invaluable asset for modern security operations. 

With the public preview now available, organizations can experience firsthand the transformative impact of the Unified Security Operations Platform. Join us in pioneering a new era of cybersecurity excellence. 

Learn More

Please visit our documentation to learn more about the supported scenarios and how to onboard multiple workspaces and tenants to the unified platform:

• https://aka.ms/UsopMTO
• https://aka.ms/OnboardMultiWS