how to have logs sent from multiple different non connected azure and aws tenants to one instance of Azure Sentinel

Darren Phillips 1

i have 1 main tenant with our azure arc and azure sentinel instance. i need to get all the machines on several non connected azure and aws tenants to send their logging to our azure sentinel. no vpns are allowed between the tenants. azure arc will work for the aws, but azure arc will not work on azure devices on a different tenant, only the main tenant. what are my options if any?

Timmy Malmgren 811 Reputation points

2024-02-14T14:59:30.1933333+00:00

Hi

I'm not sure sending the data "manually" (true Azure function/logic apps) between tenants is a very good solution, as it might loose some of it references data like (GUIDs) and you will likely need to write a lot of logic for it. Sentinel is looking at many correlations and might loose a lot of that functionality if it does not have all the references from the data, i have no real life experience in this, but I feel like it will be very complex and hard to achieve/manage (if even possible.)

If you however have another sentinel configured in the other Azure tenants you might be able to achieve the administrative overview by using Azure Lighthouse. The link below is only if you have or can consider setting up more sentinel workspaces and setup a Enterprise app for managing to the other Azure tenants.

https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

Hope this helps Kind Regards Timmy