Skip to content

Commit 4c03bbf

Browse files
Merge pull request #310520 from EdB-MSFT/clarify-lake-onboarding
update
2 parents c491897 + a8b94ae commit 4c03bbf

1 file changed

Lines changed: 5 additions & 1 deletion

File tree

articles/sentinel/datalake/sentinel-lake-onboarding.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,11 @@ During onboarding, your data lake is provisioned in the same [region](/azure/sen
123123

124124
## Existing Microsoft Sentinel workspaces
125125

126-
You must connect your Microsoft Sentinel primary workspace to the Defender portal to onboard to the data lake. Your data lake is located in the same region as your primary Sentinel workspace. You can connect other workspaces in the same region as your primary workspace to the Defender portal so you can use them with the data lake. If you onboarded to the data lake, data in Microsoft Sentinel workspaces that are connected to Defender and enabled for use with the data lake. For more information on how to connect Microsoft Sentinel to the Defender portal, see [Connect Microsoft Sentinel to the Microsoft Defender portal](/unified-secops-platform/microsoft-sentinel-onboard).
126+
You must connect your Microsoft Sentinel primary workspace to the Defender portal to onboard to the data lake. Your data lake is located in the same region as your primary Sentinel workspace. You can connect other workspaces in the same region as your primary workspace to the Defender portal so you can use them with the data lake. If you onboarded to the data lake, data in Microsoft Sentinel workspaces that are connected to Defender and enabled for use with the data lake. For more information on how to connect Microsoft Sentinel to the Defender portal, see [Connect Microsoft Sentinel to the Microsoft Defender portal](/unified-secops-platform/microsoft-sentinel-onboard).
127+
128+
You can't choose which workspaces to onboard to the data lake. All workspaces connected to Defender in the same region as your primary Sentinel workspace are onboarded automatically. You can't offboard specific workspaces from the data lake on your own. If you want to offboard a workspace, [submit a support request](/defender-xdr/contact-defender-support).
129+
130+
127131

128132
## Offboard from Microsoft Sentinel data lake and graph
129133

0 commit comments

Comments
 (0)