This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(25.6, 25%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAH%3C/text%3E%3C/svg%3E)
I need to ingest logs from my organization cross-tenant resources into our primary tenant where we've centralized Sentinel as a SIEM.
My Microsoft partner said i cannot use lighthouse option as my organisation is not a MSP. Can someone please in brief about cross-tenant log management in azure.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 17%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGM%3C/text%3E%3C/svg%3E)
@Ajhar Hussain Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back.
Please remember to "Accept Answer" if answer helped, so that others in the community facing similar issues can easily find the solution.
https://video2.skills-academy.com/en-us/azure/lighthouse/how-to/onboard-customer
if you have multiple Tenants, you can use Azure Lighthouse
Thank you, through lighthouse can I achieve requirement of managing a centralized (single) workspace in my primary tenant (Sentinel) and configure other tenant resources (WAF, Entra Activity logs, etc) to forward logs to it?
Sorry that's not the point of Azure Lighthouse, which is to grant you access to remote Microsoft Sentinel instances. So you have a Primary Sentinel and then others per Tenant. Sorry I misread your question.
I'd still go with option 3 (based on the limited requirement you mention). Keeping them seperate helps so much in many ways with connectors and data - especially if you are likely to decommission any of the remote instances in the future https://video2.skills-academy.com/en-us/azure/sentinel/sample-workspace-designs#sample-3-multiple-tenants-and-regions-and-centralized-security