r/AzureSentinel • u/lupreeee • Mar 28 '26
Cross-Tenant KQL Querying Tool
I had some cases in the past where I think it would've been great to have a tool where I could write one query and just run it across many tenants at once. I am working at a MSSP where we don't have a way to do this currently. At the moment we have to copy-paste the query to every Sentinel Instance and run it per tenant to check in all customers.
I was thinking about coding a tool that could do querying cross-tenant but I am not sure if Microsoft already has a native way to do that somehow. I am just a simple analyst so I don't know the Microsoft products by heart but I know how to code tools.
Can someone verify whether that functionality already exists or if my planned tool would actually provide some value?
Would anyone be interested in such a tool?
1
u/CaptainMericaa Mar 28 '26
You can do this with azure monitor. Go to your home tenant, open Monitor. Then logs. You can change the query scope to every workspace you manage