Forum Discussion

christian-knipping's avatar
christian-knipping
Copper Contributor
Mar 28, 2019

Multiple Subscriptions in Sentinel

Hello all,   Can I set up a central Azure Sentinel to monitor multiple subscriptions?   Or is one Azure Sentinel recommended per subscription? Best Christian
dean-h's avatar
dean-h
Copper Contributor
Aug 15, 2019

Chris BoehmIs there an aggregation capability to provide a "single pane of glass" for all CSP tenants? From the documentation, it appears that the CSP can gain delegated access to each individual tenant for Log Analytics and ASC.  This https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-experience mentions "cross-tenant visibility" for ASC, but does not show what the user experience is like. It would be nice to see a screen-shot showing multiple subscriptions from multiple Azure AD tenants in a centralized view in Sentinel and ASC.

Ofer_Shezaf's avatar
Ofer_Shezaf
Icon for Microsoft rankMicrosoft
Apr 13, 2020

dean-h 

 

We recently announced a central incident management screen which is in private preview. You can read more about working with multiple workspaces, optionally across tenants, in our archtecture webinar (MP4, YouTube) and the (updated) presentation. You may also want to register for the MSSP and distributed organization webinar on April 20th here.

  • tijan2018's avatar
    tijan2018
    Former Employee
    Dec 04, 2021
    @Ofer, I know this thread is almost a year old but I have a similar situation with multiple subscriptions but would like to use a single workspace for Sentinel. I know lighthouse is required for multi tenant but my situation is just a single tenant with multiple subscriptions and would like to use one workspace. How do I go about having this work?
    • FahadAhmed's avatar
      FahadAhmed
      Brass Contributor
      Apr 05, 2022

      tijan2018 did you get the answer how to have multiple workspaces under single tenant added in sentinel. I couldn’t find a way to get it done, any pointers that would help?

      thanks 

      • ryansp85's avatar
        ryansp85
        Copper Contributor
        Feb 13, 2023
        Has anyone ever figured this out? I can't get it to work. Policy only allows to select one subscription
    • Larssen92's avatar
      Larssen92
      Brass Contributor
      Dec 05, 2021
      If you need to get Activity Logs from the subscriptions, you can use the "Azure Activity" data connector. This works by adding a policy with the relevant subscriptions in a scope. Most likely you want your scope to be a management group consisting of all your subscriptiosn.
      • tijan2018's avatar
        tijan2018
        Former Employee
        Feb 24, 2022
        Thanks for the reply, when I checked the Azure Activity data connector, it only lets me scope to one specific subscription and there isn't an option to scope to a management group. What are your thoughts on this?