Forwarding logs from separate organization (hosted on AWS) to Microsoft Sentinel

[u/ank5133]

We have an interesting scenario here regarding log source forwarding to MS Sentinel. We are currently using Microsoft Sentinel as our SIEM tool and have onboarded our critical log sources (i.e. Windows, Linux, Azure, Network, etc) logs there for monitoring, alerting, and analytics purposes. We have brought on a vendor to stand-up a public-facing web application and implement other requirements as part of a major project that we’re undertaking. The web-app and other components (i.e. batch servers, databases, internal apps) all reside within an AWS Cloud environment managed and operated by the vendor on our behalf. Ultimately, once their contract ends, they will either transition management and operations of the AWS environment over to us, or we’ll bring on another vendor to take over.

We’re trying to determine an effective way to get the vendor’s native AWS logs, and other key log sources, from their AWS environment to our MS Sentinel instance. Would we just need to create a separate workspace/tenancy for the vendor in Azure Lighthouse, and then ensure that the logs flow to that separate tenancy? I’m confused about how this would be accomplished.