First party Alerts in Different Workspace

Occasional Contributor

Recommendation to view the “first party” (MCAS, Security Center, AADIP etc.) from different workspace


If you have KQL example, set up the rule, please do so. 


setdecide upon or fix definitelyMore (Definitions, Synonyms, Translation)

1 Reply
You can use Azure Lighthouse to connect to all the workspaces and then you can see all the incidents in one view. This should work while MS considers your idea.