Forum Discussion

christian-knipping's avatar
christian-knipping
Copper Contributor
Mar 28, 2019

Multiple Subscriptions in Sentinel

Hello all,   Can I set up a central Azure Sentinel to monitor multiple subscriptions?   Or is one Azure Sentinel recommended per subscription? Best Christian
Chris Boehm's avatar
Chris Boehm
Brass Contributor
Mar 28, 2019

christian-knipping 

 

At this time it's one Azure Sentinel Workspace per Tenant, Azure Sentinel works across subscriptions. Microsoft is in the process of looking into MSP (Managed Service Provider ) solutions but nothing has been publicly released at this time. Please feel free to reach out if you have any more questions.

Thuan Ng's avatar
Thuan Ng
Brass Contributor
Aug 13, 2019
Could you elaborate on "across subscription"?
  • Chris Boehm's avatar
    Chris Boehm
    Brass Contributor
    Aug 14, 2019
    Azure Sentinel is using Log Analytics within one tenant with one to multiple subscriptions. If you have multiple subscriptions they can interact with each other with RBAC permissions of data when pulling into a sentinel workspace. If you're wanting to know how to do “cross-tenant” data monitoring you’re required to use the MSSP solution “Azure Lighthouse” with Azure Sentinel.

    Is there a specific question to subscriptions that’s not clear in our documentation that we can improve upon?
    • FahadAhmed's avatar
      FahadAhmed
      Brass Contributor
      Apr 01, 2022

      Chris Boehm can you share link or screenshot from where I can add multiple subscriptions under one sentinel? I currently have sentinel connected to one subscription and want to connect other subscriptions under the same tenant but cant find a place to add from? 

       

      Thanks

    • dean-h's avatar
      dean-h
      Copper Contributor
      Aug 15, 2019

      Chris BoehmIs there an aggregation capability to provide a "single pane of glass" for all CSP tenants? From the documentation, it appears that the CSP can gain delegated access to each individual tenant for Log Analytics and ASC.  This https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-experience mentions "cross-tenant visibility" for ASC, but does not show what the user experience is like. It would be nice to see a screen-shot showing multiple subscriptions from multiple Azure AD tenants in a centralized view in Sentinel and ASC.

      • Ofer_Shezaf's avatar
        Ofer_Shezaf
        Icon for Microsoft rankMicrosoft
        Apr 13, 2020

        dean-h 

         

        We recently announced a central incident management screen which is in private preview. You can read more about working with multiple workspaces, optionally across tenants, in our archtecture webinar (MP4, YouTube) and the (updated) presentation. You may also want to register for the MSSP and distributed organization webinar on April 20th here.

Resources