Question

A multinational company has three business units (Finance, HR, and Retail), each managing its own set of Azure resources within a single subscription. Security requires that each business unit's operations team be able to query only the logs generated by their own resources, while a central security operations center (SOC) must retain the ability to run cross-unit queries for threat hunting. The company also wants to minimize the number of Log Analytics workspaces to reduce administrative overhead. What should you recommend?

Accepted Answer

Use a single Log Analytics workspace with resource-context (per-resource) RBAC, assigning each team access to their resources and granting the SOC workspace-context permissions.

Answer

Create a separate Log Analytics workspace for each business unit and grant the SOC read access to all three workspaces.

Answer

Create a single workspace and use table-level RBAC to grant each business unit access to different tables.

Answer

Create a single workspace and configure Azure Policy to restrict each team's Kusto queries by resource group.