Forum Discussion
Dedicated cluster for Sentinels in different tenants
Hello
I see that there is a possibility to use a dedicated cluster for a workspace in the same Azure region. What about workspaces that reside in different tenants but are in the same Azure region? Is that possible?
We are utilizing multiple tenants, and we want to keep this operational model. However, there is a central SOC, and we wonder if there is a possibility to utilize a dedicated cluster for cost optimization.
A Log Analytics dedicated cluster can be shared across workspaces that live in different Azure tenants, provided that:
- All workspaces and the cluster are in the same Azure region
- Azure Lighthouse is used to delegate both the cluster and the workspaces into a single managing tenant
This is documented in the Azure Monitor Logs – Dedicated clusters documentation:
“Linked workspaces can be in different subscriptions from the subscription the cluster is in. If you use Azure Lighthouse to map both of them to a single tenant, the workspace and cluster can be in different tenants.”
1 Reply
PaulineMbabuMicrosoft
A Log Analytics dedicated cluster can be shared across workspaces that live in different Azure tenants, provided that:
- All workspaces and the cluster are in the same Azure region
- Azure Lighthouse is used to delegate both the cluster and the workspaces into a single managing tenant
This is documented in the Azure Monitor Logs – Dedicated clusters documentation:
“Linked workspaces can be in different subscriptions from the subscription the cluster is in. If you use Azure Lighthouse to map both of them to a single tenant, the workspace and cluster can be in different tenants.”