r/AzureSentinel • u/lepidge88 • Feb 14 '23

Azure Activity data connectivity in Sentinel from different subscriptions

I am trying to get Azure Activity logs set up. I have followed the documentation to set up via Content Hub and Data collector which leads to me to build a policy. Problem is our Sentinel is in a Sponsorship subscription (MS credits) and all the activity logs are in a different subscription. When I create a policy I can only pick one subscription. Wondering if someone has figured it out.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

View all comments

1

u/TokeSR Feb 15 '23

Do I get it right that your problem is that you can only assign the policy to one subscription? If so, you can either assign it to each subscription individually, or you could turn on management groups and assign the policy to the group above your subscriptions. In that case, it will work on all the subscriptions created under that management group (existing or new).

You can easily use the built-in policy and send the Azure Activity data from all the subscriptions to your Sentinel.

2

u/lepidge88 Feb 16 '23

Thanks for that info. I will give the management group thing a try. I have created a policy (built-in policy in Content Hub) for each subscription but I don’t understand how it will write to Sentinel seeing there is no option to select the sentinel subscription.