Forum Discussion
Solved
How to add multiple workspaces to Azure Sentinel
Hi there,
Currently we have Azure Sentinel running on workspace "abc" within subscription "123". Now we would like to add another workspace "efg" that is within subscription "456" to the already running sentinel instance connected to workspace "abc".
Can any one guide me if this is even possible? if yes, how to add an additional workspace in existing sentinel instance in a different subscription?
any help will be appreciated.
Thanks
Fahad.
- Indeed, you cannot map one sentinel instance to multiple workspaces, so multiple workspaces means multiple sentinel instances.
While you have the ability to run multi-workspace queries against multiple sentinel instances in one go, you will still need manage settings and so forth separately for each sentinel instance.
8 Replies
- Just create "efg" then add it to Sentinel. Providing the subscriptions are in the same tenant (Directory) you are ok, if they are not you will need Azure Lighthouse.
- so subscriptions are in the same tenant. When you are saying "Just create "efg" then add it to Sentinel." are you referring to add this workspace to a new Azure Sentinel instance or the existing Sentinel instance that already has "abc" workspace connected? if "efg" will need to be connected then please guide how? since I am new here n dont see anything that can point of how to add an existing workspace to an existing sentinel instance that is already connected to another workspace.
From Sentinel the UI --> +Create --> you then get an option to "create New Workspace" or Add an existing one - just select a Workspace then press [add]
