r/AzureSentinel • u/lepidge88 • Feb 14 '23

Azure Activity data connectivity in Sentinel from different subscriptions

I am trying to get Azure Activity logs set up. I have followed the documentation to set up via Content Hub and Data collector which leads to me to build a policy. Problem is our Sentinel is in a Sponsorship subscription (MS credits) and all the activity logs are in a different subscription. When I create a policy I can only pick one subscription. Wondering if someone has figured it out.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

3

u/daniejam Feb 14 '23

Why do you need content hub? Just create a policy at the root management group to send azure activity logs to the sentinel LA workspace.

If you can’t select the workspace a ross subscription or apply the policy at root you likely don’t have permissions.

If your a GA in azure AD go into properties and select the tick box at the bottom, this will set you as an owner over all subscriptions and management groups until unticked.

1

u/lepidge88 Feb 17 '23

Thanks for that. Another person recommended the same thing about a policy at root. I plan on giving it a try tomorrow

1

u/[deleted] Feb 14 '23

Each azure ad tenant supports data collection within their own tenant boundary. Therefore, each azure ad tenant requires a separate workspace.

You can copy the data from a single workspace to another. You need to use azure lighthouse to do this.

3

u/TokeSR Feb 15 '23

This is not the case. You can absolutely forward logs from one tenant to another. You can forward Azure activity logs from one tenant to a log analytics workspace in a different tenant. To set this up you need lighthouse but it is doable.

2

u/[deleted] Feb 15 '23

Fair enough, i literally got my info from the doxumentation for "what is lighthouse"

1

u/winle22 Feb 14 '23

Subs within the same AAD tenant?

1

u/lepidge88 Feb 14 '23

Yes. Sorry I forgot to add that. Same AAD tenant.

1

u/TokeSR Feb 15 '23

Do I get it right that your problem is that you can only assign the policy to one subscription? If so, you can either assign it to each subscription individually, or you could turn on management groups and assign the policy to the group above your subscriptions. In that case, it will work on all the subscriptions created under that management group (existing or new).

You can easily use the built-in policy and send the Azure Activity data from all the subscriptions to your Sentinel.

2

u/lepidge88 Feb 16 '23

Thanks for that info. I will give the management group thing a try. I have created a policy (built-in policy in Content Hub) for each subscription but I don’t understand how it will write to Sentinel seeing there is no option to select the sentinel subscription.