You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/manage-access.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ The factors that define the data you can access are described in the following t
29
29
|[Access mode](#access-mode)| Method used to access the workspace. Defines the scope of the data available and the access control mode that's applied. |
30
30
|[Access control mode](#access-control-mode)| Setting on the workspace that defines whether permissions are applied at the workspace or resource level. |
31
31
|[Azure role-based access control (RBAC)](#azure-rbac)| Permissions applied to individuals or groups of users for the workspace or resource sending data to the workspace. Defines what data you have access to. |
32
-
|[Table-level Azure RBAC](#set-table-level-read-access)| Optional permissions that define specific data types in the workspace that you can access. Apply to all users no matter your access mode or access control mode. |
32
+
|[Table-level Azure RBAC](#set-table-level-read-access-preview)| Optional permissions that define specific data types in the workspace that you can access. Apply to all users no matter your access mode or access control mode. |
33
33
34
34
## Access mode
35
35
@@ -56,14 +56,14 @@ The following table summarizes the access modes:
56
56
|:---|:---|:---|
57
57
| Who is each model intended for? | Central administration.<br>Administrators who need to configure data collection and users who need access to a wide variety of resources. Also currently required for users who need to access logs for resources outside of Azure. | Application teams.<br>Administrators of Azure resources being monitored. Allows them to focus on their resource without filtering. |
58
58
| What does a user require to view logs? | Permissions to the workspace.<br>See "Workspace permissions" in [Manage access using workspace permissions](./manage-access.md#azure-rbac). | Read access to the resource.<br>See "Resource permissions" in [Manage access using Azure permissions](./manage-access.md#azure-rbac). Permissions can be inherited from the resource group or subscription or directly assigned to the resource. Permission to the logs for the resource will be automatically assigned. The user doesn't require access to the workspace.|
59
-
| What is the scope of permissions? | Workspace.<br>Users with access to the workspace can query all logs in the workspace from tables they have permissions to. See [Set table-level read access](./manage-access.md#set-table-level-read-access). | Azure resource.<br>Users can query logs for specific resources, resource groups, or subscriptions they have access to in any workspace, but they can't query logs for other resources. |
59
+
| What is the scope of permissions? | Workspace.<br>Users with access to the workspace can query all logs in the workspace from tables they have permissions to. See [Set table-level read access](./manage-access.md#set-table-level-read-access-preview). | Azure resource.<br>Users can query logs for specific resources, resource groups, or subscriptions they have access to in any workspace, but they can't query logs for other resources. |
60
60
| How can a user access logs? | On the **Azure Monitor** menu, select **Logs**.<br><br>Select **Logs** from **Log Analytics workspaces**.<br><br>From Azure Monitor [workbooks](../best-practices-analysis.md#workbooks). | Select **Logs** on the menu for the Azure resource. Users will have access to data for that resource.<br><br>Select **Logs** on the **Azure Monitor** menu. Users will have access to data for all resources they have access to.<br><br>Select **Logs** from **Log Analytics workspaces**. Users will have access to data for all resources they have access to.<br><br>From Azure Monitor [workbooks](../best-practices-analysis.md#workbooks). |
61
61
62
62
## Access control mode
63
63
64
64
The *access control mode* is a setting on each workspace that defines how permissions are determined for the workspace.
65
65
66
-
***Require workspace permissions**. This control mode doesn't allow granular Azure RBAC. To access the workspace, the user must be [granted permissions to the workspace](#azure-rbac) or to [specific tables](#set-table-level-read-access).
66
+
***Require workspace permissions**. This control mode doesn't allow granular Azure RBAC. To access the workspace, the user must be [granted permissions to the workspace](#azure-rbac) or to [specific tables](#set-table-level-read-access-preview).
67
67
68
68
If a user accesses the workspace in [workspace-context mode](#access-mode), they have access to all data in any table they've been granted access to. If a user accesses the workspace in [resource-context mode](#access-mode), they have access to only data for that resource in any table they've been granted access to.
69
69
@@ -357,7 +357,7 @@ To create a [custom role](../../role-based-access-control/custom-roles.md) that
357
357
358
358
### Legacy method of setting table-level read access
359
359
360
-
[Azure custom roles](../../role-based-access-control/custom-roles.md) let you grant access to specific tables in the workspace, although we recommend defining [table-level read access](#set-table-level-read-access) as described above.
360
+
[Azure custom roles](../../role-based-access-control/custom-roles.md) let you grant access to specific tables in the workspace, although we recommend defining [table-level read access](#set-table-level-read-access-preview) as described above.
361
361
362
362
Azure custom roles apply to workspaces with either workspace-context or resource-context [access control modes](#access-control-mode) regardless of the user's [access mode](#access-mode).
Copy file name to clipboardExpand all lines: articles/azure-monitor/logs/workspace-design.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -105,7 +105,7 @@ When you grant a user [access to a workspace](manage-access.md#azure-rbac), the
105
105
-**If you want users to be able to access data for their resources:** Keep the default access control mode of **Use resource or workspace permissions**.
106
106
-**If you want to explicitly assign permissions for all users:** Change the access control mode to **Require workspace permissions**.
107
107
108
-
[Table-level RBAC](manage-access.md#set-table-level-read-access): With table-level RBAC, you can grant or deny access to specific tables in the workspace. In this way, you can implement granular permissions required for specific situations in your environment.
108
+
[Table-level RBAC](manage-access.md#set-table-level-read-access-preview): With table-level RBAC, you can grant or deny access to specific tables in the workspace. In this way, you can implement granular permissions required for specific situations in your environment.
109
109
110
110
For example, you might grant access to only specific tables collected by Microsoft Sentinel to an internal auditing team. Or you might deny access to security-related tables to resource owners who need operational data related to their resources.
Copy file name to clipboardExpand all lines: articles/sentinel/best-practices-workspace-architecture.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -90,7 +90,7 @@ For more information, see [Data residency in Azure](https://azure.microsoft.com/
90
90
91
91
You may have situations planned where different teams will need access to the same data. For example, your SOC team must have access to all Microsoft Sentinel data, while operations and applications teams will need access to only specific parts. Independent security teams may also need to access Microsoft Sentinel features, but with varying sets of data.
92
92
93
-
Combine [resource-context RBAC](resource-context-rbac.md) and [table-level RBAC](../azure-monitor/logs/manage-access.md#set-table-level-read-access) to provide your teams with a wide range of access options that should support most use cases.
93
+
Combine [resource-context RBAC](resource-context-rbac.md) and [table-level RBAC](../azure-monitor/logs/manage-access.md#set-table-level-read-access-preview) to provide your teams with a wide range of access options that should support most use cases.
94
94
95
95
For more information, see [Permissions in Microsoft Sentinel](roles.md).
0 commit comments