Multiple Subscriptions in Sentinel

[christian-knipping]

Hello all,

Can I set up a central Azure Sentinel to monitor multiple subscriptions?

Or is one Azure Sentinel recommended per subscription?

Best

Christian

[#2]

@christian-knipping 

CC: @Chris Boehm and @Shalini Pasupneti 

[#3]

@christian-knipping 

At this time it's one Azure Sentinel Workspace per Tenant, Azure Sentinel works across subscriptions. Microsoft is in the process of looking into MSP (Managed Service Provider ) solutions but nothing has been publicly released at this time. Please feel free to reach out if you have any more questions.

[#4]

@Chris Boehm  Does it work across multiple subscriptions? Maybe I don't understand what you mean by that but I would like to bring in MCAS data from multiple tenants and that doesn't seem to be possible.

[#5]

@Andrea Fisher 

We don't have multi-tenant support at this point. If all subs are on the same tenant, than it should work.

[#6]

@Chris Boehm is there any beta program an MSP could take part in to assist in trialing features :) Any idea of when something public may be released? For now if we set up a Azure tenant for the customer will there be a migration tool to bring into multi-tenant when that option is available?

[#7]

@Jarrod Winsor 

We'll most likely make the announcement within this communities page for the preview functionality, you're already looking in the best location at this time :)

I don't have an answer at this time on the migration path if it'll just be a connection between workspaces with the key or if it'll be a different interface to integrate them. I'm sure we'll announce the details whenever they've been established.

Great question!

Thanks,

[#8]

@Chris Boehm is there any further update on multi tenant support for Sentinel?

[#9]

@Rob Ellis 

Development is already in process; if you haven't looked into it we're using Azure Lighthouse for the MSSP solution: https://azure.microsoft.com/en-us/services/azure-lighthouse/ 

[#10]

@Chris Boehm thanks - I saw Lighthouse mentioned recently - I did wonder if it was related, so good to know.

[#11]

Could you elaborate on "across subscription"?

[#12]

Azure Sentinel is using Log Analytics within one tenant with one to multiple subscriptions. If you have multiple subscriptions they can interact with each other with RBAC permissions of data when pulling into a sentinel workspace. If you're wanting to know how to do “cross-tenant” data monitoring you’re required to use the MSSP solution “Azure Lighthouse” with Azure Sentinel.

Is there a specific question to subscriptions that’s not clear in our documentation that we can improve upon?

[#13]

@Chris BoehmIs there an aggregation capability to provide a "single pane of glass" for all CSP tenants? From the documentation, it appears that the CSP can gain delegated access to each individual tenant for Log Analytics and ASC.  This article mentions "cross-tenant visibility" for ASC, but does not show what the user experience is like. It would be nice to see a screen-shot showing multiple subscriptions from multiple Azure AD tenants in a centralized view in Sentinel and ASC.