%3CLINGO-SUB%20id%3D%22lingo-sub-1382657%22%20slang%3D%22en-US%22%3ERe%3A%20What's%20New%3A%20Cross%20Workspace%20Incident%20View%20in%20Public%20Preview!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1382657%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20news%2C%20I%20really%20love%20it%20%2C%20especially%20due%20to%20COVID-19%20we%20are%20facing%20situation%20where%20more%20people%20need%20our%20help%20and%20in%20past%20it%20was%20like%20switch%20from%20this%20account%20to%20other%20account%20or%20switch%20profile.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1385192%22%20slang%3D%22en-US%22%3ERe%3A%20What's%20New%3A%20Cross%20Workspace%20Incident%20View%20in%20Public%20Preview!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1385192%22%20slang%3D%22en-US%22%3E%3CP%3EDoes%20MSSP%20also%20need%20to%20have%20their%20own%20workspace%20%3F%20or%20without%20having%20any%20workspace%20they%20will%20be%20able%20to%20manage%20their%20customer%20workspace%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1432683%22%20slang%3D%22en-US%22%3ERe%3A%20What's%20New%3A%20Cross%20Workspace%20Incident%20View%20in%20Public%20Preview!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1432683%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F536739%22%20target%3D%22_blank%22%3E%40Dev_Choudhary%3C%2FA%3EIt's%20not%20necessary%20to%20have%20your%20own%20workspace%20as%20MSSP.%20However%20you%20need%20to%20have%20access%20to%20those%20workspaces%20from%20your%20customers.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1379796%22%20slang%3D%22en-US%22%3EWhat's%20New%3A%20Cross%20Workspace%20Incident%20View%20in%20Public%20Preview!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1379796%22%20slang%3D%22en-US%22%3E%3CP%3E%3CEM%3EThis%20installment%20is%20part%20of%20a%20broader%20series%20to%20keep%20you%20up%20to%20date%20with%20the%20latest%20features%20in%20Azure%20Sentinel.%20The%20installments%20will%20be%20bite-sized%20to%20enable%20you%20to%20easily%20digest%20the%20new%20content.%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3ETo%20take%20full%20advantage%20of%20Azure%20Sentinel%E2%80%99s%20capabilities%2C%20Microsoft%20recommends%20using%20a%20%3CEM%3Esingle-workspace%20environment%3C%2FEM%3E.%20However%2C%20there%20are%20some%20use%20cases%20that%20require%20having%20several%20workspaces%2C%20in%20some%20cases%20%E2%80%93%20for%20example%2C%20that%20of%20a%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fmultiple-tenants-service-providers%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%20data-linktype%3D%22relative-path%22%3EManaged%20Security%20Service%20Provider%20(MSSP)%3C%2FA%3E%26nbsp%3Band%20its%20customers%20%E2%80%93%20across%20multiple%20tenants.%20If%20you%20are%20an%20MSSP%20who's%20managing%20multiple%20customers%20or%20a%20customer%20with%20multiple%20workspaces%2C%20you%20are%20most%20likely%20facing%20a%20challenge%20managing%20security%20across%20all%20these%20environments.%20To%20help%20alleviate%20the%20challenge%20and%20provide%20a%20centralized%20pane%2C%26nbsp%3Bwe%20are%20delighted%20to%20announce%20that%20the%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ECross%20Workspace%20Incident%20View%20is%20now%20in%20public%20preview.%20%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%221%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EThis%20feature%20is%20designed%20to%20provide%20a%20single%20pane%20%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eview%20of%20incidents%20across%20several%20workspaces%20in%20one%20incidents%20page%20and%20provides%20the%20ability%20to%20investigate%20them%20as%20if%20you%20were%20connected%20to%20the%20original%20environment.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559685%26quot%3B%3A-5%2C%26quot%3B335559739%26quot%3B%3A165%2C%26quot%3B335559740%26quot%3B%3A259%2C%26quot%3B335559991%26quot%3B%3A10%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20aria-level%3D%221%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH3%20id%3D%22toc-hId-1146196086%22%20id%3D%22toc-hId-1146196086%22%3E%3CSTRONG%3EHow%20to%20use%3F%3C%2FSTRONG%3E%3C%2FH3%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%20data-leveltext%3D%22%251.%22%20data-font%3D%22Calibri%2C%20Calibri_MSFontService%2C%20sans-serif%22%20data-listid%3D%2223%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EFrom%20the%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eportal%2C%20n%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eavigate%20to%20Azure%20Sentinel%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A5%2C%26quot%3B335559740%26quot%3B%3A249%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%251.%22%20data-font%3D%22Calibri%2C%20Calibri_MSFontService%2C%20sans-serif%22%20data-listid%3D%2223%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EFrom%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Et%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ehe%20workspace%20selector%20page%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%2C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eyou%20can%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Enow%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eselect%20several%20workspace%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Es%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20click%20the%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%9C%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EMultiple%20Sentinel%20Incidents%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%9D%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233279%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A5%2C%26quot%3B335559740%26quot%3B%3A249%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22CrossWS.gif%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F190599iEEC8A112C228D073%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22CrossWS.gif%22%20alt%3D%22CrossWS.gif%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENote%3A%26nbsp%3B%3CSPAN%3EMultiple%20Workspace%20View%20currently%20supports%20a%20maximum%20of%2010%20concurrently%20displayed%20workspaces%3C%2FSPAN%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20will%20then%20be%20navigated%20to%20a%20new%20pane%20that%20will%20provide%20you%20a%20centralized%20place%20to%20consume%20incidents%20across%20several%20workspaces.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22CrossWS2.gif%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F190617iA14E9CD1533E964B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22CrossWS2.gif%22%20alt%3D%22CrossWS2.gif%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CP%3EThe%20counters%20at%20the%20top%20of%20the%20page%20-%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3EOpen%20incidents%3C%2FEM%3E%2C%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3ENew%20incidents%3C%2FEM%3E%2C%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CEM%3EIn%20progress%3C%2FEM%3E%2C%20etc.%20-%20show%20the%20numbers%20for%20all%20of%20the%20selected%20workspaces%20collectively.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CP%3EYou'll%20see%20incidents%20from%20all%20of%20the%20selected%20workspaces%20and%20directories%20(tenants)%20in%20a%20single%20unified%20list.%20You%20can%20filter%20the%20list%20by%20workspace%20and%20directory%2C%20in%20addition%20to%20the%20filters%20from%20the%20regular%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EIncidents%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Escreen.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CP%3EYou'll%20need%20to%20have%20read%20and%20write%20permissions%20on%20all%20the%20workspaces%20from%20which%20you've%20selected%20incidents.%20If%20you%20have%20only%20read%20permissions%20on%20some%20workspaces%2C%20you'll%20see%20warning%20messages%20if%20you%20select%20incidents%20in%20those%20workspaces.%20You%20won't%20be%20able%20to%20modify%20those%20incidents%20or%20any%20others%20you've%20selected%20together%20with%20those%20(even%20if%20you%20do%20have%20permissions%20for%20the%20others).%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CP%3EIf%20you%20choose%20a%20single%20incident%20and%20click%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EView%20full%20details%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3Eor%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3EInvestigate%3C%2FSTRONG%3E%2C%20you%20will%20from%20then%20on%20be%20in%20the%20data%20context%20of%20that%20incident's%20workspace%20and%20no%20others.%3C%2FP%3E%0A%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH2%20id%3D%22toc-hId-1758710297%22%20id%3D%22toc-hId-1135692982%22%20id%3D%22toc-hId-1135692982%22%3EGet%20started%20today!%3C%2FH2%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20encourage%20you%20to%20use%20the%20new%20Cross%20Workspace%20Incident%20View%20feature%20to%20obtain%20a%20single%20pane%20view%20of%20incidents%20across%20several%20workspaces.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20additional%20information%2C%20please%20refer%20to%20the%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fmultiple-workspace-view%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%22%3E%20Cross%20Workspace%20Incidents%20View%20public%20documentation.%20%3C%2FA%3E%3C%2FP%3E%0A%3CP%3ETry%20it%20out%2C%20and-ERR%3AREF-NOT-FOUND-%26nbsp%3Blet%20us%20know%26nbsp%3Bwhat%20you%20think!%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1379796%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%3EWe%20are%20delighted%20to%20announce%20that%20the%20Cross%20Workspace%20Incident%20View%20is%20now%20in%20public%20preview!%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22CrossWS.gif%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F190626i773D92008F699D5A%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20title%3D%22CrossWS.gif%22%20alt%3D%22CrossWS.gif%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1379796%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWhat's%20New%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E

This installment is part of a broader series to keep you up to date with the latest features in Azure Sentinel. The installments will be bite-sized to enable you to easily digest the new content.

 

To take full advantage of Azure Sentinel’s capabilities, Microsoft recommends using a single-workspace environment. However, there are some use cases that require having several workspaces, in some cases – for example, that of a Managed Security Service Provider (MSSP) and its customers – across multiple tenants. If you are an MSSP who's managing multiple customers or a customer with multiple workspaces, you are most likely facing a challenge managing security across all these environments. To help alleviate the challenge and provide a centralized pane, we are delighted to announce that the Cross Workspace Incident View is now in public preview.

 

This feature is designed to provide a single pane view of incidents across several workspaces in one incidents page and provides the ability to investigate them as if you were connected to the original environment. 

 

How to use?

 

  1. From the portal, navigate to Azure Sentinel 
  2. From the workspace selector pageyou can now select several workspaces and click the Multiple Sentinel Incidents 

 

CrossWS.gif

 

Note: Multiple Workspace View currently supports a maximum of 10 concurrently displayed workspaces 

 

You will then be navigated to a new pane that will provide you a centralized place to consume incidents across several workspaces. 

 

CrossWS2.gif

 

  • The counters at the top of the page - Open incidents, New incidents, In progress, etc. - show the numbers for all of the selected workspaces collectively.

 

  • You'll see incidents from all of the selected workspaces and directories (tenants) in a single unified list. You can filter the list by workspace and directory, in addition to the filters from the regular Incidents screen.

 

  • You'll need to have read and write permissions on all the workspaces from which you've selected incidents. If you have only read permissions on some workspaces, you'll see warning messages if you select incidents in those workspaces. You won't be able to modify those incidents or any others you've selected together with those (even if you do have permissions for the others).

 

  • If you choose a single incident and click View full details or Investigate, you will from then on be in the data context of that incident's workspace and no others.

 

Get started today!

 

We encourage you to use the new Cross Workspace Incident View feature to obtain a single pane view of incidents across several workspaces.

 

For additional information, please refer to the  Cross Workspace Incidents View public documentation.

Try it out, and let us know what you think!

 

4 Comments
Valued Contributor

Great news, I really love it , especially due to COVID-19 we are facing situation where more people need our help and in past it was like switch from this account to other account or switch profile.

Occasional Contributor

Does MSSP also need to have their own workspace ? or without having any workspace they will be able to manage their customer workspace?

 

Senior Member

@Dev_ChoudharyIt's not necessary to have your own workspace as MSSP. However you need to have access to those workspaces from your customers.

Microsoft

@Dennis de Roo 

This feature allow sentinel to monitor cross tenant without MSSP ?