Windows Events Forward from another subscription

Copper Contributor

Hi all,

 

I have created a Sentinel connector 'Windows Events Forward' where I specified Azure VMs for data collection in a subscription I have access to.

There is another subscription in the tenant - which I don't have access to and therefore cannot select VMs for data collection from Sentinel connector. 

Anyone knows what needs to be done following least privilege principle so I can select VMs from that subscription under sentinel connector? 

1 Reply

Hey @someread87 

 

You will need access in the short term to apply the data connector across the subscription to connect the VMs into Sentinel, or someone that does have access to apply the configuration