Module 5: Designing & Configuring a Sentinel Workspace
Sentinel is where your detection engineering, automation, and hunting happen. Every analytics rule, every playbook, every workbook, and every threat hunt you build in Modules 10, 23-28 runs on the workspace you configure here.
This module covers the decisions that are hard to change later — workspace architecture, log tier assignments, retention policies, and cost controls. Get these right now and you avoid expensive rework when your ingestion doubles in six months.
You need an Azure subscription connected to your M365 tenant. If you set up the developer tenant in Module 1.11, connect an Azure free subscription to it now — Step 4 in those instructions. The free tier includes 5 GB/day of Sentinel ingestion, which is sufficient for all lab exercises in this module.