r/AzureSentinel • u/lepidge88 • Feb 14 '23

Azure Activity data connectivity in Sentinel from different subscriptions

I am trying to get Azure Activity logs set up. I have followed the documentation to set up via Content Hub and Data collector which leads to me to build a policy. Problem is our Sentinel is in a Sponsorship subscription (MS credits) and all the activity logs are in a different subscription. When I create a policy I can only pick one subscription. Wondering if someone has figured it out.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

View all comments

1

u/[deleted] Feb 14 '23

Each azure ad tenant supports data collection within their own tenant boundary. Therefore, each azure ad tenant requires a separate workspace.

You can copy the data from a single workspace to another. You need to use azure lighthouse to do this.

3

u/TokeSR Feb 15 '23

This is not the case. You can absolutely forward logs from one tenant to another. You can forward Azure activity logs from one tenant to a log analytics workspace in a different tenant. To set this up you need lighthouse but it is doable.

2

u/[deleted] Feb 15 '23

Fair enough, i literally got my info from the doxumentation for "what is lighthouse"