Set up multiple workspaces and tenants in Microsoft Sentinel

When you planned your deployment, you determined whether a multiple workspace architecture is relevant for your environment. If your environment requires multiple workspaces, you can now set them up as part of your deployment. For more information, see Prepare for multiple workspaces and tenants in Microsoft Sentinel.

In this article, you learn how to set up Microsoft Sentinel to extend across multiple workspaces and tenants. This article is part of the Deployment guide for Microsoft Sentinel.

Options for using multiple workspaces

Starting in July 2026, all customers using Microsoft Sentinel in the Azure portal will be redirected to the Defender portal and will use Microsoft Sentinel in the Defender portal only. Starting in July 2025, many new users are also automatically onboarded and redirected from the Azure portal to the Defender portal. If you're still using Microsoft Sentinel in the Azure portal, we recommend that you start planning your transition to the Defender portal to ensure a smooth transition and take full advantage of the unified security operations experience offered by Microsoft Defender. For more information, see It’s Time to Move: Retiring Microsoft Sentinel’s Azure portal for greater security.

After you set up your environment to extend across workspaces, you can:

• Manage and monitor your cross-workspace architecture: Query and analyze your data across workspaces and tenants.

  • If you're onboarding to the Microsoft Defender portal, see Multiple Microsoft Sentinel workspaces in the Defender portal and Microsoft Defender multitenant management.
  • To work in the Azure portal, see Extend Microsoft Sentinel across workspaces and tenants.

• Manage multiple workspaces: Centrally manage multiple workspaces within one or more tenants.

  • For the Defender portal, see Multiple Microsoft Sentinel workspaces in the Defender portal and Microsoft Defender multitenant management.
  • To work in the Azure portal, see Centrally manage multiple Microsoft Sentinel workspaces with workspace manager within one or more Azure tenants.

For each tenant, the Defender portal allows you to connect to one primary workspace and multiple secondary workspaces for Microsoft Sentinel (preview). For more information, see Microsoft Defender multitenant management.

Next steps

In this article, you learned how to set up Microsoft Sentinel to extend across multiple workspaces and tenants.