Question

Contoso operates 30 subscriptions across multiple business units. The security operations team needs a single, centralized location to query Azure Firewall logs, NSG flow logs, and Azure Activity logs from all subscriptions for cross-subscription threat hunting and correlation. Individual business units must retain the ability to access only the logs from their own resources for troubleshooting. Which logging design should you recommend?

Accepted Answer

Create a single centralized Log Analytics workspace, route all diagnostic and Activity logs to it, and use resource-context RBAC so business units see only logs for resources they can access.

Answer

Create one Log Analytics workspace per subscription and configure the SecOps team with a saved cross-workspace query using the workspace() function, while granting business units Reader on their own workspace.

Answer

Send all logs to a single Azure Storage account in the security subscription and grant SecOps and business units SAS tokens scoped to relevant containers.

Answer

Configure each subscription to send logs to Event Hubs and have the SecOps team consume them with a third-party SIEM, giving business units no direct log access.