Forum Discussion
Multiple vendor monitoring single Azure sentinel console
pavankemi For that to work you would need to use the 2nd option and setup custom roles that can then be used in the Table level RBAC. It should be noted that all users will be able to see all incidents in the environment and if they can modify one they can modify all.
Depending on what data sources are required for all the queries, you may want to see about using 2 different Azure Sentinel environments and use Azure Lighthouse to be able to see both in one view for the people that need to see all of the incidents.
pavankemi There are two ways to do this (and I am not sure Azure Lighthouse would work correctly)
1) Use Azure Lighthouse to allow access to your environment from the 2 vendors. One vendor would have all the needed rights and the second would only use the Azure Sentinel Reader role. Then, and this is the part I am not sure would work since I have not tested it, setup the Table Level RBAC but instead of using a custom role, use the Azure Sentinel Reader role to limit what can be seen.
2) Either create accounts for the various people on your environment or use B2B and then create the custom roles to use with table level RBAC.
pavankemi For that to work you would need to use the 2nd option and setup custom roles that can then be used in the Table level RBAC. It should be noted that all users will be able to see all incidents in the environment and if they can modify one they can modify all.
Depending on what data sources are required for all the queries, you may want to see about using 2 different Azure Sentinel environments and use Azure Lighthouse to be able to see both in one view for the people that need to see all of the incidents.