Forum Discussion
Multiple Subscriptions in Sentinel
Hello all, Can I set up a central Azure Sentinel to monitor multiple subscriptions? Or is one Azure Sentinel recommended per subscription? Best Christian
@Ofer, I know this thread is almost a year old but I have a similar situation with multiple subscriptions but would like to use a single workspace for Sentinel. I know lighthouse is required for multi tenant but my situation is just a single tenant with multiple subscriptions and would like to use one workspace. How do I go about having this work?
If you need to get Activity Logs from the subscriptions, you can use the "Azure Activity" data connector. This works by adding a policy with the relevant subscriptions in a scope. Most likely you want your scope to be a management group consisting of all your subscriptiosn.