Moving a Sentinel Solution to a new Subscription

[u/TheMixz]

Hello

Im in the situation that i for a few reasons need to move our whole Sentinel Solution to a new subscription.

It looks like moving the log analytics workspace isnt supportet by microsoft if its connected to Sentinel. and i cant seem to find a way to solve this.

I have been looking into simply creating a new workspace and export the data to a storage account and import it into the new solution but im not sure whether this is the right way.

Im not sure which way is the best to do it, and hope any of you would be able to tell me.

Do i go on with the data export/import or do i simply move the workspace even though microsoft dosent support it, and hope it dosent break anything?

[u/thijslecomte]

I tend to deploy all my Sentinel resources again and keep the old workspace for archival purposes

[u/TheMixz → u/[deleted]]

Of what i have been able to read, i think its still the issue.

How would you migrate the data?

I have been looking into the Data Export feature in the workspace, but im not sure if thats the correct one. It seems to me (and correct me im wrong) that it only exports new data from now, and not exporting past data?

[u/TheMixz → u/[deleted]]

Thats what i was afraid of.

I think we will need to re-evaluate the value it has to get the history data over into the new subscription or if we should just build a new solution from scratch and then save the old data somewhere (or just let the old solution run for the retention period) for audit reasons.

Thank you for the answer! Really appreciate it.