#View monit logs code

To protect your intellectual property, you can use playbooks and workbooks to work across tenants without sharing code directly with customers.

Able to use a multi-workspace view when working through Azure Lighthouse.

Easy to add or remove new subsidiaries or customers.

Data from all data sources and data connectors that are integrated with Microsoft Sentinel (such as Azure AD Activity Logs, Office 365 logs, or Microsoft Threat Protection alerts) will remain within each customer tenant.

Related costs are charged to each managed tenant, rather than to the managing tenant.

Prevents data exfiltration from the managed tenants, helping to ensure data compliance.

Ensures data isolation, since data for multiple customers isn't stored in the same workspace.

Supports requirements to store data within geographical boundaries.

Ownership of data remains with each managed tenant.

This model of centralized management has the following advantages: Similarly, enterprises with multiple Azure AD tenants may want to centrally manage multiple Microsoft Sentinel workspaces deployed across their tenants. Architectural considerationsįor a managed security service provider (MSSP) who wants to build a Security-as-a-Service offering using Microsoft Sentinel, a single security operations center (SOC) may be needed to centrally monitor, manage, and configure multiple Microsoft Sentinel workspaces deployed within individual customer tenants. However, you can't delegate resources across a national cloud and the Azure public cloud, or across two separate national cloud. You can manage delegated resources that are located in different regions.