Microsoft Sentinel workspaces, roles and data connectors
Sentinel is a SIEM that is only as good as the data it receives and the access it grants. The exam keeps testing workspace design, built-in roles and connectors.
Workspace design
Sentinel is enabled on a Log Analytics workspace. Start with a single workspace and split only when there is a real reason:
| Reason | Result |
|---|---|
| Data must stay in a region | Separate workspace per region |
| Different tenants | One workspace per tenant, managed with Azure Lighthouse |
| Different retention or ownership | Separate workspace |
| Only access separation | Stay with one workspace and use RBAC (table-level or resource-context) |
Cross-workspace queries use the workspace("name") function, and incidents from several workspaces appear in one view. In the Defender portal, a Sentinel workspace can be onboarded to the unified Microsoft Defender XDR experience; the Azure portal Sentinel experience is being retired.
Built-in roles
Assign roles at the resource group or workspace level.
| Role | Can do |
|---|---|
| Microsoft Sentinel Reader | View data, incidents, workbooks |
| Microsoft Sentinel Responder | Reader plus manage incidents (assign, close, comment) |
| Microsoft Sentinel Contributor | Responder plus create and edit rules, workbooks, connectors |
| Microsoft Sentinel Automation Contributor | Lets Sentinel run playbooks (assigned to the Sentinel service, not to people) |
| Logic App Contributor | Create and edit playbooks |
Running a playbook manually needs Microsoft Sentinel Playbook Operator on the playbook’s resource group.
Data connectors
Pick the connector by source:
- Service to service (Microsoft Entra ID, Azure Activity, Microsoft Defender XDR) use built-in connectors.
- Windows events use Windows Security Events via AMA. You can filter by event ID, for example to collect audit failures only.
- Linux and network devices use Syslog via AMA or Common Event Format (CEF) via AMA through a Linux forwarder.
- Anything else can use the REST API, the Codeless Connector Framework or Logstash.
Data collection rules (DCRs) decide what the agent sends. Use ingestion-time transformations in the DCR to drop columns or rows and save cost. The older Log Analytics agent (MMA) was retired in August 2024; the Azure Monitor Agent (AMA) replaces it.
Exam traps
- Responder cannot edit rules; Contributor can. Pick the lowest role that meets the task.
- Sentinel Automation Contributor is for the Sentinel service identity, not analysts.
- Guest accounts across tenants are the wrong answer when Lighthouse is available.
- Separate workspaces are not needed just to restrict who sees which data.
- MMA and the Log Analytics agent are legacy; current answers use AMA.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. A SOC analyst must dismiss and assign incidents but must not edit analytics rules or workbooks. Which role gives the least privilege?
Show answer
Answer: B.Microsoft Sentinel Responder can manage incidents but cannot create or edit rules and workbooks. Contributor adds those rights.
2. A managed provider must see and manage Sentinel data in a customer tenant without guest accounts. What should it use?
Show answer
Answer: A.Azure Lighthouse delegates access to the customer subscription and workspace so no guest accounts are needed.
3. A team must edit the queries of existing custom workbooks and do nothing else in Sentinel. Which role should you assign?
Show answer
Answer: A.Workbook Contributor allows editing workbooks only, while Reader can only view them.
4. You want to collect Windows security events from servers into Sentinel. Which connector is current?
Show answer
Answer: B.The Windows Security Events via AMA connector uses the Azure Monitor Agent with data collection rules. The Log Analytics agent (MMA) is retired.