How to add in Sentinel a tenant from Office 365?

Michael Deacon 21

The options for MSPS and CSPs to add new tenants to their own Sentinel workspace seems to be a bit of mystery, unless you are using Azure Lighthouse.

This is a very common scenario, where the customer has only an Office 365 subscription and no other Azure subscription: Azure Lighthouse onboarding would not work them in this case.

...so how can we onboard this customer to our own managed Sentinel workspace, as the option to add tenants seems to have been removed earlier in the year.

JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2020-10-14T18:08:28.477+00:00

@Michael Deacon
Thank you for your post!

Have you looked into the Connect Office 365 Logs to Azure Sentinel documentation?

Additional Links:
Connect data sources
Extend Azure Sentinel across workspaces and tenants

I hope this helps, if you have any other questions please let me know.
Thank you for your time and patience throughout this issue.
Michael Deacon 21 Reputation points

2020-10-14T18:58:16.59+00:00

Yes, I have looked at those links, but they don't apply to my scenario: my tenant that is hosting Sentinel is NOT the same as the O365 tenant.

My scenario applies to all the MSPs that want to onboard other O365 tenants to their own Sentinel workspace hosted and managed by the MSP.

It is a very typical scenarios that I am very surprised MS has overlooked so far.
JamesTran-MSFT 36,621 Reputation points Microsoft Employee

2020-10-14T20:12:45.267+00:00

@Michael Deacon
Thank you for the quick response and clarification!

I'll reach out to my team regarding this issue and provide an update as soon as possible.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Accepted answer

JoyZ 18,066 Reputation points

2020-10-15T05:55:20.137+00:00

Hi @Michael Deacon ,

Currently the ability to add multiple tenants in Azure Sentinel has been deprecated.

Quote from Microsft:

If you had previously connected multiple tenants to Azure Sentinel, using an older version of the Office 365 connector which supported this, you will be able to view and modify which logs you collect from each tenant. You will not be able to add additional tenants, but you can remove previously added tenants.

For better data privacy and security, it' s necessary to use Azure Lighthouse for cross- and multi-tenant management.

https://learn.microsoft.com/en-us/azure/lighthouse/how-to/manage-sentinel-workspaces

Thank you for your understanding.

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

1 person found this answer helpful.
Michael Deacon 21 Reputation points

2020-10-15T14:14:03.61+00:00

..and as I mentioned before, 99% of the Office 365 customers do NOT have any Azure subscriptions, so we cannot onboard them in Lighthouse. How can we offer them managed Sentinel services in this case?

JoyZ 18,066 Reputation points

2020-10-16T09:20:12.643+00:00

Hi @Michael Deacon ,

In my opinion, it's not possible to meet your requirement without Azure subscriptions.

In this case, I would propose a new support ticket to be raised to have a dedicated Technical Professional to support you from there.

Michael Deacon 21 Reputation points

2020-10-16T14:04:14.957+00:00

I see. Thanks for the clarification.

It is very disappointing to learn this, as this leaves out of reach the majority of Office 365 users.

JoyZ 18,066 Reputation points

2020-10-20T01:15:53.873+00:00

If you find any answer helpful to you, please remember to accept it as answer.

Thank you for your understanding.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to add in Sentinel a tenant from Office 365?

0 additional answers

Your answer