Sentinel workspace

New Contributor

Hello,

If all the Virtual machines are connected to a Sentinel workspace and at the same time I have enabled Defender for Cloud for Virtual Machines, will this make the mma agent in the VMs report to two workspaces and store logs on both Sentinel workspace and Defender for cloud workspace?

Thanks in Adv.

3 Replies
You should have Defender for Cloud and Microsoft Sentinel sharing the same workspace.
Thanks @rodtrent, but from a cost perspective Sentinel pricing will be applicable to all the logs that are ingested from Defender for cloud some of which might not have any security value right?
That is correct. You will need to decide how much of that extra data is being ingested compared to the value of other data being available to Sentinel