Sentinel workspace

[Pramodkm]

Hello,

If all the Virtual machines are connected to a Sentinel workspace and at the same time I have enabled Defender for Cloud for Virtual Machines, will this make the mma agent in the VMs report to two workspaces and store logs on both Sentinel workspace and Defender for cloud workspace?

Thanks in Adv.

[#2]

You should have Defender for Cloud and Microsoft Sentinel sharing the same workspace.

[#3]

Thanks @Rod_Trent, but from a cost perspective Sentinel pricing will be applicable to all the logs that are ingested from Defender for cloud some of which might not have any security value right?

[#4]

That is correct. You will need to decide how much of that extra data is being ingested compared to the value of other data being available to Sentinel

[#5]

Hello @Rod_Trent, just to clarify. We should set our continuous export log analytics workspace as the same workspace set for Sentinel?
Cheers