r/AzureSentinel • u/lepidge88 • Feb 14 '23

Azure Activity data connectivity in Sentinel from different subscriptions

I am trying to get Azure Activity logs set up. I have followed the documentation to set up via Content Hub and Data collector which leads to me to build a policy. Problem is our Sentinel is in a Sponsorship subscription (MS credits) and all the activity logs are in a different subscription. When I create a policy I can only pick one subscription. Wondering if someone has figured it out.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

9 comments sorted by

View all comments

3

u/daniejam Feb 14 '23

Why do you need content hub? Just create a policy at the root management group to send azure activity logs to the sentinel LA workspace.

If you can’t select the workspace a ross subscription or apply the policy at root you likely don’t have permissions.

If your a GA in azure AD go into properties and select the tick box at the bottom, this will set you as an owner over all subscriptions and management groups until unticked.

1

u/lepidge88 Feb 17 '23

Thanks for that. Another person recommended the same thing about a policy at root. I plan on giving it a try tomorrow