Breaking the 10 Workspace Barrier for Azure Sentinel

There’s a current limit to the number of workspaces that can be selected to manage at a single time when opening the Azure Sentinel environment. That current barrier is 10 workspaces. 10 workspaces may sound like a lot for most organizations, but there are some customers – particularly MSSPs – that need to view more than 10 at a time.

Not many know this, but there’s a Workbook template that you can enable in Azure Sentinel that allows you to select more than 10 workspaces. This Workbook is an example of the power of KQL and cross-workspace queries.

The Workbook is called: “Sentinel Central“