Sentinel across multi-region/workspaces

Jeff Walzer No need to pair them. You can have multiple workspaces and query across them using a single Azure Sentinel console. Here's an example...

union Update, workspace("otherworkspacename").Update, workspace("otherworkspaceID").Update
| where TimeGenerated >= ago(1h)
| where UpdateState == "Needed"
| summarize dcount(Computer) by Classification

You can even save a query like this as a Function so you can just use the Function alias to use it.

Question is...why do you think you might need multiple Sentinel workspaces? Best practice is to use a single workspace if possible.

Reasons why you might want to use multiple workspaces:

• Use of multiple Azure tenants
• For compliance and sovereignty reasons
• To reduce networking costs across regions

Reasons to avoid multiple workspaces:

• Separate billing
• Fine grained retention settings
• Fine grained access control
• Legacy architecture