Forum Discussion
Solved
How to add multiple workspaces to Azure Sentinel
Hi there, Currently we have Azure Sentinel running on workspace "abc" within subscription "123". Now we would like to add another workspace "efg" that is within subscription "456" to the already ...
- Indeed, you cannot map one sentinel instance to multiple workspaces, so multiple workspaces means multiple sentinel instances.
While you have the ability to run multi-workspace queries against multiple sentinel instances in one go, you will still need manage settings and so forth separately for each sentinel instance.
Clive, I think Fahad was asking if it's possible to map one Sentinel instance to multiple workspaces.
@FahadAhmed Please let me know if I'm wrong, Fahad.
If we follow your suggestion Clive, we will have multiple Sentinels: one for each log analytics workspace. That seems right to me. It is not possible to connect multiple workspaces to a single Sentinel instance, isn't it?
Thanks
Indeed, you cannot map one sentinel instance to multiple workspaces, so multiple workspaces means multiple sentinel instances.
While you have the ability to run multi-workspace queries against multiple sentinel instances in one go, you will still need manage settings and so forth separately for each sentinel instance.
While you have the ability to run multi-workspace queries against multiple sentinel instances in one go, you will still need manage settings and so forth separately for each sentinel instance.
- Thanks Jonhed , Clive_watson and Sergei. Appreciate your support and clarifications.
