Microsoft Security Operations AnalystMitigate threats using Microsoft SentinelMedium
A security architect is designing a Microsoft Sentinel deployment for a multinational corporation. The corporation has strict data residency requirements, stipulating that all security logs generated in a specific geographic region must be stored and processed exclusively within that region. How should the architect ensure this requirement is met for Microsoft Sentinel?
- AEnable geo-redundant storage for the Sentinel workspace.
- BDeploy a separate Log Analytics workspace in each required geographic region.
- CConfigure Azure Private Link for all data connectors.
- DUse Azure ExpressRoute to connect all regional networks to a central Sentinel instance.
Show answer & explanationAnswer & explanation
Correct answer: B. Deploy a separate Log Analytics workspace in each required geographic region.
Microsoft Sentinel's data is stored in a Log Analytics workspace. To meet data residency requirements for specific geographic regions, a separate Log Analytics workspace must be deployed in each region where data needs to reside, as the workspace's region dictates data storage.
Why the other options are wrong
- A. Geo-redundant storage (GRS) replicates data across regions for disaster recovery, which violates strict data residency requirements that data must *only* reside in a specific region.
- C. Azure Private Link ensures private connectivity, not data residency. Data would still reside where the connected service is located.
- D. Azure ExpressRoute provides private connectivity but doesn't dictate where data is stored; data would still be sent to a specific workspace region.
Microsoft Sentinel Data Residency
Microsoft Sentinel adheres to Azure's data residency principles, primarily by storing data within the geographic region of the associated Log Analytics workspace. To enforce regional residency, separate workspaces must be deployed in each required region.
- Data residency is tied to Log Analytics workspace region.
- Multiple workspaces needed for multi-region residency.
- Ensures data stays within specified geographic boundaries.
Memory trick: For 'Regional' data, create a 'Regional Workspace' to keep it home.