Question

Your organization operates a central SOC in Microsoft Sentinel that must push a standardized set of analytics rules, hunting queries, and automation rules to 40 member workspaces belonging to different business units and Azure Active Directory (Entra ID) tenants. You need a native, repeatable way to author content once in a central workspace and distribute it to all member workspaces without manually re-creating rules in each one. Which approach should you implement?

Accepted Answer

Enable Microsoft Sentinel workspace manager on the central workspace, add the member workspaces to a workspace group, and publish the content items to them

Answer

Configure Azure Lighthouse delegated access and use cross-workspace analytics rules that query all member workspaces from the central workspace

Answer

Enable multi-workspace incident view in the Microsoft Sentinel portal so incidents from all 40 workspaces are managed centrally

Answer

Export each analytics rule as an ARM template and manually deploy it to each member workspace through the Azure portal