Set up multiple workspaces and tenants in Microsoft Sentinel

• Applies to:

  Microsoft Sentinel in the Azure portal and the Microsoft Defender portal

When you planned your deployment, you determined whether a multiple workspace architecture is relevant for your environment. If your environment requires multiple workspaces, you can now set them up as part of your deployment. For more information, see Prepare for multiple workspaces and tenants in Microsoft Sentinel.

In this article, you learn how to set up Microsoft Sentinel to extend across multiple workspaces and tenants. This article is part of the Deployment guide for Microsoft Sentinel.

Options for using multiple workspaces

After you set up your environment to extend across workspaces, you can:

• Manage and monitor your cross-workspace architecture: Query and analyze your data across workspaces and tenants.
  • To work in the Azure portal, see Extend Microsoft Sentinel across workspaces and tenants.
  • If your organization onboards Microsoft Sentinel to the Microsoft Defender portal, see Microsoft Defender multitenant management.

For Microsoft Sentinel in the Azure portal, you can:

• Manage multiple workspaces with workspace manager: Centrally manage multiple workspaces within one or more Azure tenants. For more information, see Centrally manage multiple Microsoft Sentinel workspaces with workspace manager.

Only one Microsoft Sentinel workspace per tenant is currently supported in the Microsoft Defender portal. For more information, see Microsoft Defender multitenant management.

Next steps

In this article, you learned how to set up Microsoft Sentinel to extend across multiple workspaces and tenants.

Enable User and Entity Behavior Analytics (UEBA)