SOLVED

Combining Security Center for multiple tenants

%3CLINGO-SUB%20id%3D%22lingo-sub-390517%22%20slang%3D%22en-US%22%3ECombining%20Security%20Center%20for%20multiple%20tenants%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-390517%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWe%20operate%20dozens%20of%20CSP%20customers%20and%20want%20to%20combine%20all%20of%20the%20log%20data%20into%20one%20repository.%20Each%20customer%20has%20a%20separate%20tenant.%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3ENormally%20this%20is%20not%20a%20problem%20because%20I%20point%20MMA%20towards%20the%20desired%20combined%20workspace.%20The%20problem%20comes%20with%20the%20Security%20event%20log%20and%20how%20it%20interacts%20with%20Security%20Center.%20Apparently%20to%20get%20that%20log%20source%2C%20our%20subscription%20has%20to%20be%20enrolled%20into%20Security%20Center%20paid.%26nbsp%3B%3C%2FSPAN%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3CSPAN%3EIn%20the%20portal%2C%20the%20only%20selection%20for%20Log%20Analytic%20workspaces%20are%20the%20ones%20in%20the%20tenant.%20I%20need%20to%20be%20able%20to%20set%20the%20Security%20Center%20workspace%20to%20one%20in%20another%20tenant.%20Is%20that%20possible%20to%20do%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-390921%22%20slang%3D%22en-US%22%3ERe%3A%20Combining%20Security%20Center%20for%20multiple%20tenants%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-390921%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F293935%22%20target%3D%22_blank%22%3E%40Valon_Kolica%3C%2FA%3E%20and%26nbsp%3B%3CA%20style%3D%22background-color%3A%20transparent%3B%20box-sizing%3A%20border-box%3B%20color%3A%20%230077d4%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoeui%26amp%3Bquot%3B%2C%26amp%3Bquot%3Blato%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Carial%2Csans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20outline-color%3A%20invert%3B%20outline-style%3A%20none%3B%20outline-width%3A%200px%3B%20text-align%3A%20left%3B%20text-decoration%3A%20underline%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F297038%22%20target%3D%22_blank%22%3E%40stevecatmull%3C%2FA%3E%3CSPAN%20style%3D%22display%3A%20inline%20!important%3B%20float%3A%20none%3B%20background-color%3A%20%23ffffff%3B%20color%3A%20%23333333%3B%20font-family%3A%20'SegoeUI'%2C'Lato'%2C'Helvetica%20Neue'%2CHelvetica%2CArial%2Csans-serif%3B%20font-size%3A%2016px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20300%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ECurrently%20Azure%20Security%20Center%20doesn't%20support%20multiple%20tenants%2C%20but%20this%20feature%20is%20on%20the%20roadmap%20and%20should%20be%20coming%20this%20year.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-390912%22%20slang%3D%22en-US%22%3ERe%3A%20Combining%20Security%20Center%20for%20multiple%20tenants%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-390912%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F297038%22%20target%3D%22_blank%22%3E%40stevecatmull%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F124214%22%20target%3D%22_blank%22%3E%40Yuri%20Diogenes%3C%2FA%3E%3A%20Is%20this%20something%20you%20can%20speak%20to%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
New Contributor

We operate dozens of CSP customers and want to combine all of the log data into one repository. Each customer has a separate tenant.

Normally this is not a problem because I point MMA towards the desired combined workspace. The problem comes with the Security event log and how it interacts with Security Center. Apparently to get that log source, our subscription has to be enrolled into Security Center paid. 

In the portal, the only selection for Log Analytic workspaces are the ones in the tenant. I need to be able to set the Security Center workspace to one in another tenant. Is that possible to do?

2 Replies

@stevecatmull 

 

@Yuri Diogenes: Is this something you can speak to? 

Best Response confirmed by stevecatmull (New Contributor)
Solution

Hello @Valon_Kolica and @stevecatmull 

 

Currently Azure Security Center doesn't support multiple tenants, but this feature is on the roadmap and should be coming this year.