Search code examples
azureazure-securityazure-rbacazure-sentinel

Azure Sentinel RBAC - Best Practice

We are in the process of implmenting Sentinel with several data sources, what is the best way to do the RBAC?

Solution

  • You would just create the dashboard from Azure Sentinel and assign RBAC roles to it the same way you would with any other Resource in Azure.

    The quickstart guide covers it:

    1. To create a new dashboard from scratch, select Dashboards and then +New dashboard.

    2. Select the subscription the dashboard is created in and give it a descriptive name. Each dashboard is an Azure resource like any other, and you can assign it roles (RBAC) to define and limit who can access.

    3. To enable it to show up in your dashboards to pin visualizations to, you have to share it. Click Share and then Manage users.

    4. Use the Check access and Role assignments as you would for any other Azure resource. For more information, see Share Azure dashboards by using RBAC.

    Let me know if this helps.