Workspace Manager
Microsoft Sentinel workspace manager centrally manages analytics rules, automation rules, parsers, saved searches, hunting queries, and workbooks across parent and member Sentinel workspaces for managed-tenant and enterprise multi-workspace operations.
capabilitiesCurrent
Relationships
Configuration Methods
| Method | Support | Reference or Gap |
|---|---|---|
| Portal | Supported | Reference |
| PowerShell | Gap | No dedicated PowerShell cmdlet surface is recorded for workspace manager. Use ARM/REST/AzAPI for repeatable deployment. |
| REST API | Supported | Reference |
| Graph | Gap | Workspace manager is a Microsoft.SecurityInsights ARM resource family, not a Microsoft Graph Security resource. |
| ARM | Supported | Reference |
| Bicep | Supported | Reference |
| Terraform | Supported | azapiazapi_resource Reference azurerm does not have dedicated workspace manager resources; use azapi_resource for Microsoft.SecurityInsights/workspaceManagerAssignments, groups, members, and configurations. |
| GitHub Actions | Supported | Reference |
| Azure DevOps | Supported | Reference |