How to add in Sentinel a tenant from Office 365?

Question

The options for MSPS and CSPs to add new tenants to their own Sentinel workspace seems to be a bit of mystery, unless you are using Azure Lighthouse.

This is a very common scenario, where the customer has only an Office 365 subscription and no other Azure subscription: Azure Lighthouse onboarding would not work them in this case.

...so how can we onboard this customer to our own managed Sentinel workspace, as the option to add tenants seems to have been removed earlier in the year.

Answer 1

Hi @Michael Deacon ,

Currently the ability to add multiple tenants in Azure Sentinel has been deprecated.

Quote from Microsft:

If you had previously connected multiple tenants to Azure Sentinel, using an older version of the Office 365 connector which supported this, you will be able to view and modify which logs you collect from each tenant. You will not be able to add additional tenants, but you can remove previously added tenants.

For better data privacy and security, it' s necessary to use Azure Lighthouse for cross- and multi-tenant management.

https://learn.microsoft.com/en-us/azure/lighthouse/how-to/manage-sentinel-workspaces

Thank you for your understanding.

---

If an Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.