MicrosoftWe're just in the closing stages of consolidating all of our Log Analytics Workspaces into a single centralised on because of the previous inability to use Union in queries which has meant lots of pain trying to manage the RBAC within that workspace, so individual teams can see and report on their own resources only.
It's quite frustrating that this new capability has surfaced just at this time! 🙂
If cross-workspace querying is now possible, and it's also possible that our engineering teams may create their own workspaces, is there any way that the Sentinel queries can be dynamically changed to always include *all* workspaces (including any new ones), across the whole tenancy, or within a specific management group?
