You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: unified-secops-platform/microsoft-sentinel-onboard.md
+10-2Lines changed: 10 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -105,7 +105,7 @@ This procedure describes how to onboard a Microsoft Sentinel-enabled workspace t
105
105
106
106
1. Select the **Primary workspace**.
107
107
108
-
1. Read and understand the product changes associated with connecting your workspace.
108
+
1. Read and understand the product changes associated with connecting your workspace.
109
109
110
110
1. Select **Connect**.
111
111
@@ -131,9 +131,13 @@ Find Microsoft Sentinel settings in the Defender portal under **System** > **Set
131
131
You can only have one primary workspace connected to the Defender portal at a time. But you can change the primary workspace.
132
132
133
133
1. In the [Defender portal](https://security.microsoft.com/), go to **System** > **Settings** > **Microsoft Sentinel** > **Workspaces**.
134
+
134
135
1. Select the name of the workspace that you want to make primary.
136
+
135
137
1. Select **Set as primary**.
138
+
136
139
1. Read and understand the product changes associated with changing the primary workspace.
140
+
137
141
1. Select **Confirm and proceed**.
138
142
139
143
When you switch the primary workspace for Microsoft Sentinel, the Defender XDR connector is connected to the new primary and disconnected from the former one automatically. For more information, see [Multiple Microsoft Sentinel workspaces in the Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2310579).
@@ -145,9 +149,13 @@ If you decide to offboard a workspace from the Defender portal, disconnect the w
145
149
If your workspace has the [Microsoft Defender XDR connector](/azure/sentinel/connect-microsoft-365-defender) configured, offboarding the workspace from the Defender portal will also disconnect the Microsoft Defender XDR connector.
146
150
147
151
1. Go to the [Microsoft Defender portal](https://security.microsoft.com/) and sign in.
152
+
148
153
1. In the Defender portal, under **System**, select **Settings** > **Microsoft Sentinel**.
154
+
149
155
1. On the **Workspaces** page, select the connected workspace and **Disconnect workspace**.
150
-
1. Provide a reason why you're disconnecting the workspace.
156
+
157
+
1. Provide a reason why you're disconnecting the workspace.
158
+
151
159
1. Confirm your selection.
152
160
153
161
When your workspace is disconnected, the **Microsoft Sentinel** section is removed from the left-hand side navigation of the Defender portal. Data from Microsoft Sentinel is no longer included on the **Home** page.
0 commit comments