Log Analytics design considerations

You've already learned that Microsoft Defender for Cloud and Microsoft Sentinel rely heavily on Azure Log Analytics. But there are some important considerations to make before you start your security monitoring journey in the cloud.

The three most important paradigms in this context are as follows:

• Use as few Log Analytics workspaces as possible.
• Use regional workspaces to avoid Azure bandwidth costs.
• Use different workspaces for security and performance monitoring

From a technical point of view, it's best to only use a single, central workspace so all the data resides in one place. Having a single workspace, you can easily, efficiently, and quickly correlate your data to get the respective insights. You also only need to take care of a single role-based access control (RBAC) model for this workspace. However, fine-grained RBAC models demand more effort.

Important Note

Remember that you cannot use the default...