There’s a current limit to the number of workspaces that can be selected to manage at a single time when opening the Azure Sentinel environment. That current barrier is 10 workspaces. 10 workspaces may sound like a lot for most organizations, but there are some customers – particularly MSSPs – that need to view more than 10 at a time.
Not many know this, but there’s a Workbook template that you can enable in Azure Sentinel that allows you to select more than 10 workspaces. This Workbook is an example of the power of KQL and cross-workspace queries.
The Workbook is called: “Sentinel Central“
FYI: This 10 workspace limit should expand in the future.
[Subscribe to the RSS feed for this blog]
[Subscribe to the Weekly Azure Sentinel Newsletter]