Guidance on moving Sentinel for Brownfield customers

[paulgrimley]

It would be good to understand / update our guidance on migrating / moving Sentinel to the ESLZ mgmt group structure for our Brownfield Sentinel customers as its currently unsupported to move Log Analytics Workspaces to another resource group or subscription as documented here https://docs.microsoft.com/en-us/azure/azure-monitor/logs/move-workspace#workspace-move-considerations.

Options could be to recommend moving the sub and removing anything unrelated to management to other subscriptions where it is supported to do so therefore aligning to the design principles appreciating naming conventions may not be aligned.

[jtracey93]

We are working on updating the brownfield guidance and this topic will be covered in depth for sure.

However @paulgrimley is correct and our guidance is to leave it as is as the platform doesn’t support migrating the workspace and solutions to different subscriptions etc. Today.

So the existing workspace becomes the centralised one as part of ESLZ and you move the subscription into the correct management group (management) and then migrate the other resources in that resource group out of it over time by doing new deployments or migrating the resources.

Hope that helps.

And we will be updating docs in the coming months to detail this further 👍

[jtracey93]

Trigger ADO Sync 1

[jtracey93]

Trigger ADO Sync 2