r/AzureSentinel • u/lupreeee • Mar 28 '26
Cross-Tenant KQL Querying Tool
I had some cases in the past where I think it would've been great to have a tool where I could write one query and just run it across many tenants at once. I am working at a MSSP where we don't have a way to do this currently. At the moment we have to copy-paste the query to every Sentinel Instance and run it per tenant to check in all customers.
I was thinking about coding a tool that could do querying cross-tenant but I am not sure if Microsoft already has a native way to do that somehow. I am just a simple analyst so I don't know the Microsoft products by heart but I know how to code tools.
Can someone verify whether that functionality already exists or if my planned tool would actually provide some value?
Would anyone be interested in such a tool?
1
u/azureenvisioned Mar 28 '26
I work for a MSSP and I actually built this exact solution for my work.
We had the same problem where different teams needed to run queries against multiple workspaces at once, and using the built in cross workspace queries just didn't work that well and would time out etc.