Log analytics Workspace Design Considerations - Recommendations & Technical Guidance

[SebastiaanR]

Hi community,

Is there some technical guidance or recommendations related to the LA workspace designs when it comes to the onboarding of resources to Defender for Cloud, i.e. have a single LAW for all resources, or split it out according to some or other plan?

Also, enabling Defender for Cloud at subscription level rather than LA level? Although I suppose this would make sense if you only wanted to include some resources under a subscription instead of a blanket enablement?
Thanks

[#2]

Hi there,
While we don't have a guidance specifically for MDC, i would recommend reviewing the following articles:
https://docs.microsoft.com/en-us/azure/defender-for-cloud/faq-data-collection-agents
https://docs.microsoft.com/en-us/azure/azure-monitor/logs/design-logs-deployment