Breaking the 10 Workspace Barrier for Azure Sentinel

There’s a current limit to the number of workspaces that can be selected to manage at a single time when opening the Azure Sentinel environment. That current barrier is 10 workspaces. 10 workspaces may sound like a lot for most organizations, but there are some customers – particularly MSSPs – that need to view more than 10 at a time.

Not many know this, but there’s a Workbook template that you can enable in Azure Sentinel that allows you to select more than 10 workspaces. This Workbook is an example of the power of KQL and cross-workspace queries.

The Workbook is called: “Sentinel Central

Choose more

FYI: This 10 workspace limit should expand in the future.


[Want to discuss this further? Hit me up on Twitter or LinkedIn]

[Subscribe to the RSS feed for this blog]

[Subscribe to the Weekly Azure Sentinel Newsletter]