Listen to this Post
Join us for an insightful webinar where we delve into the intricacies of managing multiple workspaces and tenants within the unified security operations platform.
Registration link: https://lnkd.in/dXqA6zsG
Microsoft Security Community blog: https://lnkd.in/d5SxBzva
You Should Know:
1. Connecting Multiple Workspaces in Microsoft Sentinel
To manage multiple workspaces, use the `Add-AzSentinelWorkspace` PowerShell command:
Add-AzSentinelWorkspace -ResourceGroupName "SecOps-RG" -WorkspaceName "Workspace-2" -PrimaryWorkspace "Workspace-1"
2. Cross-Tenant Log Querying with KQL
Use Kusto Query Language (KQL) to fetch logs from different workspaces:
union workspace("Workspace-1").SecurityEvent, workspace("Workspace-2").SecurityEvent
| where EventID == 4625
3. Automating Threat Detection Across Tenants
Deploy Azure Logic Apps to synchronize alerts:
New-AzLogicApp -ResourceGroupName "CrossTenant-SecOps" -Name "Sync-Sentinel-Alerts" -Definition .\sync_alerts.json
4. Linux Command for Sentinel Log Forwarding
If using Syslog to forward logs to Sentinel:
sudo rsyslogd -N 1 && sudo systemctl restart rsyslog
5. Windows Event Forwarding to Sentinel
Configure Windows Event Collector with:
wecutil qc /q winrm quickconfig
6. API-Based Log Ingestion
Use Log Analytics API to push custom logs:
curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $token" --data-binary @logs.json "https://api.loganalytics.io/v1/workspaces/{workspaceId}/logs"
7. Multi-Tenant RBAC Setup
Assign roles across tenants using:
New-AzRoleAssignment -ObjectId <user-object-id> -RoleDefinitionName "Security Reader" -Scope "/tenants/{tenant-id}"
What Undercode Say:
Managing multiple Microsoft Sentinel workspaces and tenants requires automation, cross-workspace queries, and proper RBAC controls. Key takeaways:
- Use KQL for cross-workspace analytics
- Automate log synchronization with Logic Apps
- Leverage PowerShell for bulk workspace management
- Forward Linux/Windows logs efficiently
- Monitor API-based log ingestion for custom sources
Expected Output:
A streamlined multi-tenant Sentinel deployment with centralized threat detection, automated log aggregation, and role-based access control.
Prediction:
As cloud environments grow, cross-tenant SecOps will become critical, with more AI-driven automation for threat correlation in Microsoft Sentinel. Expect deeper Azure Lighthouse integrations for seamless multi-tenant security management.
References:
Reported By: Dimitar Grozdanov – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
