Sentinel Services on Azure Portal Showing Non-Sentinel Enabled Workspaces as Well

Gorav Gandhi 1 Reputation point
2024-03-25T05:30:32.03+00:00

I have two Log analytics Workspaces, only one with Sentinel enabled, but both the workspaces are shown on Sentinel page on Azure portal, which makes it confusing. Is this default behaviour or can be switched off?

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
986 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Stanislav Zhelyazkov 21,336 Reputation points MVP
    2024-03-25T07:28:35.24+00:00

    Hi, No, it should show only Sentinel enabled Log Analytics workspaces. This means that both workspaces are enabled for Sentinel. The workspaces that you do not want to be enabled you can disable by deleting SecurityInsights(<workspace name>) solution from the resource group where the workspace is located.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

    0 comments