capability

Workspace Manager

Microsoft Sentinel workspace manager centrally manages analytics rules, automation rules, parsers, saved searches, hunting queries, and workbooks across parent and member Sentinel workspaces for MSSP and enterprise multi-workspace operations.

capabilitiesCurrent

Relationships

Microsoft Sentinel
Source productproductSecurityAlert
Related tabletableSecurityIncident
Related tabletableMicrosoft Sentinel REST API
API accessapi

Configuration Methods

MethodSupportReference or Gap
PortalSupported Reference
PowerShellGapNo dedicated PowerShell cmdlet surface is recorded for workspace manager. Use ARM/REST/AzAPI for repeatable deployment.
REST APISupported Reference
GraphGapWorkspace manager is a Microsoft.SecurityInsights ARM resource family, not a Microsoft Graph Security resource.
ARMSupported Reference
BicepSupported Reference
TerraformSupportedazapiazapi_resource Reference

azurerm does not have dedicated workspace manager resources; use azapi_resource for Microsoft.SecurityInsights/workspaceManagerAssignments, groups, members, and configurations.

GitHub ActionsSupported Reference
Azure DevOpsSupported Reference