Forum Discussion
Azure Sentinel Instances per Subscription
Hello all, This will be my first post here! At present we have implemented 5 instances of Azure Sentinel per the 5 subscriptions of our 1 Azure Tenancy. After doing some research it seems t...
Rod_Trent
Brilliant, glad to hear that i'm onto the right solution, is there any written documentation to enforce this method? Thanks for coming back to me.
Also would it wise to use only the Log Analytics workspace attached to Azure Sentinel exclusively for Sentinel or can you pump other logs from other Azure resources into the same space and it not matter? I'd assume it would be better to keep them purely aligned to Sentinel to assist with billing etc?
Brilliant, glad to hear that i'm onto the right solution, is there any written documentation to enforce this method? Thanks for coming back to me.
Also would it wise to use only the Log Analytics workspace attached to Azure Sentinel exclusively for Sentinel or can you pump other logs from other Azure resources into the same space and it not matter? I'd assume it would be better to keep them purely aligned to Sentinel to assist with billing etc?
Rod_Trent
Microsoft
MicrosoftBest practice is to only send Sentinel-related data into the Log Analytics workspace. Otherwise, you are paying Sentinel costs for data you're not using for security purposes.