Forum Discussion
Multiple Subscriptions in Sentinel
Hello all, Can I set up a central Azure Sentinel to monitor multiple subscriptions? Or is one Azure Sentinel recommended per subscription? Best Christian
Ofer_Shezaf
Microsoft
Microsoft
We recently announced a central incident management screen which is in private preview. You can read more about working with multiple workspaces, optionally across tenants, in our archtecture webinar (MP4, YouTube) and the (updated) presentation. You may also want to register for the MSSP and distributed organization webinar on April 20th here.
@Ofer, I know this thread is almost a year old but I have a similar situation with multiple subscriptions but would like to use a single workspace for Sentinel. I know lighthouse is required for multi tenant but my situation is just a single tenant with multiple subscriptions and would like to use one workspace. How do I go about having this work?
tijan2018 did you get the answer how to have multiple workspaces under single tenant added in sentinel. I couldn’t find a way to get it done, any pointers that would help?
thanks
- Has anyone ever figured this out? I can't get it to work. Policy only allows to select one subscription
- If you need to get Activity Logs from the subscriptions, you can use the "Azure Activity" data connector. This works by adding a policy with the relevant subscriptions in a scope. Most likely you want your scope to be a management group consisting of all your subscriptiosn.
- Thanks for the reply, when I checked the Azure Activity data connector, it only lets me scope to one specific subscription and there isn't an option to scope to a management group. What are your thoughts on this?
