Need Help With Azure Onboarding

[msef280]

Hi Team,

I need assistance with Azure onboarding. So in my organization different team manages azure so they are the owners. I will be only working on Sentinel part. We do have the license which includes Sentinel but I was asked to find out pre-requisite for Sentinel. Based on the documentation I do see dedicated workspace is needed & also need contributor access for that workspace but as I am not the admin & have currently no access to azure so I am just wondering what will be the best option for me to ask the other team member in order to activate Sentinel.
So is it the best option to get temporary admin access of azure so I can create workspace by myself or if I have to give instruction to other team to enable Sentinel then what are the steps I can follow? Any suggestion would be appreciated 

[#2]

@msef280 You do not necessarily need a dedicated workspace but it is better to use one to avoid excess charges.   If your company already has a Log Analytics workspace that it is using, and you want all the data to be in Azure Sentinel, you can use that.   

Otherwise, you need to look at all the regions your company will be using and if there will be data produced in those regions that need to go into Azure Sentinel.   Take into account the egress charges and determine if it will be better to use one workspace or multiple workspaces.  Take a look at this post for more information: Best practices for designing an Azure Sentinel or Azure Security Center Log Analytics workspace - Mi...

Also, keep in mind, that even if you get the rights to create Azure Sentinel, you will need to have either Security Administrator or Global Administrator to setup some of the data connectors.  A lot companies will not allow anyone outside of the IT department to have those rights so you will need to work with someone who has them to get everything setup.

I would also take a look at the Azure Sentinel All-in-one deployment, Azure-Sentinel/Tools/Sentinel-All-In-One at master · Azure/Azure-Sentinel (github.com), as a way to get your Azure Sentinel environment started.   You can then add the additional data connectors you need later.

[#3]

Hi Gary,

Thanks a lot for the response. So if I don't have any access at all to Azure & my other members basically managing it then what should be the best approach from my side. So basically what i want is to activate azure sentinel but I want to do it by myself.

[#4]

@msef280 : the challenge is that there is no such thing as a Sentinel license. The cost is based on actual use. As a result, we obviously need someone with the right permissions to onboard Sentinel and essentially approve the charges. Same as for example creating a VM on Azure: it costs, so someone with the right permissions is needed to create it.