Sentinel Workbook External Sharing

[leo_szalk]

Is it possible to share workbooks to Lighthouse customers without having to create a B2B guest user? 

We created a custom dashboard to share with a customer that contains a mix of data hosted in our tenant (incidents, alerts, etc) and data from their tenant (AD & O365 logs).

I saw in the documentation it's possible via PowerBI, which as a ultimate last resort we'll likely do. But was more interested in something native so we don't have to add another layer of complexity to this with PowerBI.

[#2]

@leo_szalk You can share workbooks.  Where is the workbook going to live?  In your tenant or the client tenant?   BTW, are you using Azure Lighthouse to work with the client's Azure Sentinel instance (in which case the alerts and incidents are still stored in their environment).

[#3]

Hi Gary,

The workbook will be hosted in our tenant.

We have the customer alerts hosted in our tenant as well, via cross-workspace queries.

Since we have other customers we're managing Sentinel for, we only want to give read-only access to this particular workbook and not access to any other resource, given that other customer data (alerts/incidents) are hosted in our tenant as well.

[#4]

@leo_szalk Unfortunately, workbooks do not have individual permissions.  If you can access one, you can access them all.