Log analytics workspace for Azure 800-171 Initiative

[Dean Gross]

When deploying the NIST 800-171 Initiative there is a parameter for "Log Analytics workspace ID for virtual machine agent reporting", should this be the same workspace that is used by Sentinel or different one?  @TJBanasik 

[#2]

@Dean Gross Are you trying to install the Solution NIST SP 800-53 from Sentinel Content hub? While installing a solution (after you select "Create") you need to specify a workspace for the deployment to proceed fine and that workspace needs to have Sentinel enabled. Please let me know if this is the scenario you are looking for or please share solution information or content information and steps that you are following. Thanks.

FYI @TJBanasik 

[#3]

Dean, thanks for reaching out. Based on your thoughts, I'm assuming you're use case is related to the Microsoft Sentinel: Cybersecurity Maturity Model Certification (CMMC) 2.0 Solution which references the Microsoft Defender for Cloud: NIST SP 800-171 R2 Regulatory Compliance initiative as a prerequisite. Yes, prerequisite requires MDfC Continuous Export to a Log Analytics workspace which brings the policy assessments into Microsoft Sentinel and yes you should use your Microsoft Sentinel instance for this data. The links below provide respective solution overview, demo, and readme resources. https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/announcing-the-microsoft-sentinel-cyb... , https://youtu.be/-_a5HxJgriE , https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CybersecurityMaturityModelCertificatio...