Forum Discussion

msef280's avatar
msef280
Copper Contributor
May 19, 2022

Monitor Different Tenant Using Microsoft Sentinel

Hi Team,

 

We have license for our current tenant but we are getting a new domain with separate tenant which will be using O365. Can I monitor the new domain using my existing subscription & also what will be the cost for that or it is included with Sentinel?

microsoft defender for cloud

3 Replies

  • mikhailf's avatar
    mikhailf
    Iron Contributor
    May 19, 2022

    Hello msef280,

     

    Azure Lighthouse can be used to connect to other tenants.

    But you will also have to create a Sentinel for each tenant you want to connect to (hence the price will be for each Sentinel separately). 

    You can use only one Sentinel for creating rules, workbooks, etc.   

    Please, check this article: Manage multiple tenants in Microsoft Sentinel as a Managed Security Service Provider | Microsoft Docs to get more details about Azure Lighthouse.

    • msef280's avatar
      msef280
      Copper Contributor
      Jun 23, 2022
      Hi,

      Thanks a lot for the reply so basically I need to create a dedicated "workspace" correct & merge both "Sentinel" workspace together with lighthouse I guess. Do I need to have different subscription too?
      • Clive_Watson's avatar
        Clive_Watson
        Bronze Contributor
        Jun 24, 2022

        msef280 

        You have a Azure Tenant today with a Subscription and ResourceGroup(s) that has Sentinel and Log Analytics - if I keep the list simple.
        In your new Tenant you create a new Subscription (or use an existing one) and ResourceGroup for Log Analytics and Sentinel (essentially you copy what you have in the original to the new Tenant).

        You then link the two with Lighthouse.

        Then when you open the Sentinel portal, you will see both Workspaces, but from two Directories (Tenants)/Subscriptions

Resources