KQL Beginner: how to centralize my logs

imrichard83 

Two resources you may find handy.

https://techcommunity.microsoft.com/t5/Azure-Sentinel/Best-practices-for-designing-an-Azure-Sentinel-or-Azure-Security/ba-p/832574 

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/design-logs-deployment

and 

https://techcommunity.microsoft.com/t5/Azure-Log-Analytics/Log-Analytics-Workspace-with-Multiple-subscription/m-p/324805

I cant see what Azure region you are in or where your users & services are located but typically if you were in EUROPE (for example) and have subscriptions in a single Directory/Tenant I'd start with one workspace and only add others by exception (Compliance, business factors etc...).