Moving Sentinel to a different management group

Sándor Tőkési 251 Reputation points
2024-05-23T12:30:00.3566667+00:00

Hey folks,

I know that moving Sentinel from one subscription to a different one is not supported and can break things.

Could somebody tell me, whether moving a whole subscription that contains a Sentinel instance from one management group to another can break things or not? (beside permissions, which I'm okay with). Based on my experience, if I move my whole subscription to a different management group my Sentinel keeps working just fine.

But I would like to get some official confirmation or hear your experience as well.

Microsoft Sentinel
Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,257 questions
{count} votes

2 answers

Sort by: Most helpful
  1. Akshay-MSFT 17,931 Reputation points Microsoft Employee
    2024-05-28T04:32:14.4566667+00:00

    @Sándor Tőkési

    Thanks for your time and patience. I was able to check this internally and got the following updates:

    Subscription which has sentinel resource can be moved to  another management group but the configuration/functionalities (can't be defined based upon the data connectors, workbooks etc. used ) could break. My recommendation here would be to start the migration on staging/test env do a through testing and then proceed with production.

    If you don't have any further queries and the suggestion works as per your business need. Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

    Thanks,

    Akshay Kaushik

    0 comments No comments

  2. Sándor Tőkési 251 Reputation points
    2024-12-08T13:19:05.55+00:00

    have successfully moved multiple Sentinel instances from one Management Group to another without changing the Subscription.

    While I haven't encountered any issues so far, I cannot recommend this action until there is an official statement from Microsoft confirming it is safe, as I can't guarantee that nothing will break.

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.