#RES WORKSPACE MANAGER POLICY PREFERENCE HOW TO#

Navigate to workspace manager and select 'Add workspaces'.Onboard some or all of the workspaces in the tenant, and across multiple tenants as well (if Azure Lighthouse is enabled). Member workspaces are the set of workspaces managed by workspace manager. Once enabled, a new menu Workspace manager (preview) appears under Configuration. Navigate to the Settings blade in the parent workspace, and toggle On the workspace manager configuration setting to 'Make this workspace a parent'.

For example, a conglomerate that manages multiple subsidiaries, where each subsidiary also manages multiple workspaces.Įnable workspace manager on the central workspaceĮnable the central workspace once you have decided which Microsoft Sentinel workspace should be the workspace manager. N-Tier supports complex scenarios where a central workspace controls another central workspace.For example, workspaces simultaneously managed by an in-house SOC team and an MSSP. Co-Management supports scenarios where more than one central workspace needs to manage a member workspace.Control all member workspaces with only one central workspace. Direct-link is the least complex setup.Create a new Microsoft Sentinel workspace or utilize an existing one to serve as the central workspace.ĭepending on your scenario, consider these architectures:

To learn more, see Manage Microsoft Sentinel workspaces at scale.Ĭonfigure a central workspace to be the environment where you consolidate content items and configurations to be published at scale to member workspaces. Enable Azure Lighthouse if you're managing workspaces across multiple Azure AD tenants.To learn more about roles in Microsoft Sentinel, see Roles and permissions in Microsoft Sentinel. The Microsoft Sentinel Contributor role assignment is required on the central workspace (where workspace manager is enabled on), and on the member workspace(s) the contributor needs to manage.One workspace to manage from and at least one other workspace to be managed. You need at least two Microsoft Sentinel workspaces.Here are the active content types supported with workspace manager: Whether you're a global enterprise or a Managed Security Services Provider (MSSP), workspace manager helps you operate at scale efficiently. This article takes you through provisioning and usage of workspace manager.

#RES WORKSPACE MANAGER POLICY PREFERENCE HOW TO#

Learn how to centrally manage multiple Microsoft Sentinel workspaces within one or more Azure tenants with workspace manager.

Res workspace manager policy preference