| title | Set up multiple workspaces and tenants in Microsoft Sentinel | ||
|---|---|---|---|
| description | If you've defined that your environment needs multiple workspaces, you now set up your multiple workspace architecture in Microsoft Sentinel. | ||
| author | batamig | ||
| ms.topic | how-to | ||
| ms.date | 07/16/2025 | ||
| ms.author | bagol | ||
| appliesto |
|
When you planned your deployment, you determined whether a multiple workspace architecture is relevant for your environment. If your environment requires multiple workspaces, you can now set them up as part of your deployment. For more information, see Prepare for multiple workspaces and tenants in Microsoft Sentinel.
In this article, you learn how to set up Microsoft Sentinel to extend across multiple workspaces and tenants. This article is part of the Deployment guide for Microsoft Sentinel.
[!INCLUDE unified-soc-preview-without-alert]
After you set up your environment to extend across workspaces, you can:
-
Manage and monitor your cross-workspace architecture: Query and analyze your data across workspaces and tenants.
- If you're onboarding to the Microsoft Defender portal, see Multiple Microsoft Sentinel workspaces in the Defender portal and Microsoft Defender multitenant management.
- To work in the Azure portal, see Extend Microsoft Sentinel across workspaces and tenants.
-
Manage multiple workspaces: Centrally manage multiple workspaces within one or more tenants.
- For the Defender portal, see Multiple Microsoft Sentinel workspaces in the Defender portal and Microsoft Defender multitenant management.
- To work in the Azure portal, see Centrally manage multiple Microsoft Sentinel workspaces with workspace manager within one or more Azure tenants.
For each tenant, the Defender portal allows you to connect to one primary workspace and multiple secondary workspaces for Microsoft Sentinel (preview). For more information, see Microsoft Defender multitenant management.
In this article, you learned how to set up Microsoft Sentinel to extend across multiple workspaces and tenants.
[!div class="nextstepaction"]