MDCA/MCAS logs to IaaS/PaaS tenant Sentinel aggregated sentinel workspace

[chouma]

Hi C1

SOC has asked us to look into the potential for getting MDCA/MCAS logs from the PROD M365 tenant into sentinel in the IaaS/PaaS tenant.
Microsoft said ok the call that this would require some custom fields or something to move the log files.

Do you have an idea of how to get this done, or should we request some assistance from Microsoft to get us started analysing/planning this?

Who said this: Either Ward Pauvels, Leslie or someone else from Microsoft on the recent multi-tenant architecture review meeting.

Warmly

Claus Cramon Houmann
DIGIT.S2 Cloud Security