Is Moving the Sentinel Workspace to Another Resource Group or Subscription Supported?

No, no, no, no! Maybe.

This is a common question and one that needs both an answer and a Docs location to always find the answer. Digging around in the Microsoft Sentinel Docs may not yield the answer you’re looking for. The answer is located in the Azure Monitor Doc for Workspace move considerations (URL: https://docs.microsoft.com/en-us/azure/azure-monitor/logs/move-workspace#workspace-move-considerations).

Per the Doc:

Currently, after Microsoft Sentinel is deployed on a workspace, moving the workspace to another resource group or subscription isn’t supported.

There’s more good guidance in this location, too, (see next image) so keep the link handy.

[Want to discuss this further? Hit me up on Twitter or LinkedIn]

[Subscribe to the RSS feed for this blog]

[Subscribe to the Weekly Microsoft Sentinel Newsletter]

[Subscribe to the Weekly Microsoft Defender Newsletter]

[Learn KQL with the Must Learn KQL series and book]