We operate dozens of CSP customers and want to combine all of the log data into one repository. Each customer has a separate tenant.
Normally this is not a problem because I point MMA towards the desired combined workspace. The problem comes with the Security event log and how it interacts with Security Center. Apparently to get that log source, our subscription has to be enrolled into Security Center paid.
In the portal, the only selection for Log Analytic workspaces are the ones in the tenant. I need to be able to set the Security Center workspace to one in another tenant. Is that possible to do?
