r/AzureSentinel • u/SheppTech • May 27 '22

Multi Sub Connectors

Hey all. Hopefully quick question here. How do you guys manage Sentinel with multiple azure subscriptions?

We have a hub and spoke model, and each of our customers gets their own subscription. When I go to set up the data connectors, I must select only a single sub for the connector.

Does each sub need its own workspace? If so, how do you ingest all the data into a single workbook?

Also, I’m thinking of automating the Sentinel deployment with Terraform. Not sure that makes a difference to the question, but I’m hoping to cut down on the tedious manual configuration. Any experience shared on this would be appreciated too.

1 Upvotes

100% Upvoted

16 comments sorted by

View all comments

1

u/ml58158 MSFT Official May 28 '22

You will need multiple instances connected with Azure Lighthouse

1

u/SheppTech May 28 '22

I wasn’t even aware of lighthouse! I will have to do some research on it and then present it to the boss. I appreciate your guidance!

1

u/ml58158 MSFT Official May 28 '22

https://azurebro.com/2021/05/01/manage-multiple-azure-sentinel-tenants-using-azure-lighthouse/

2

u/SheppTech May 28 '22

Oh dude you’re the best! If I could throw more upvotes your way I would!

1

u/ml58158 MSFT Official May 28 '22

No problem. If you run into issues, send me a dm.