Cross-Workspace Queries in Microsoft Sentinel
Your organization uses Microsoft Sentinel and has multiple workspaces for different regions. The security team wants to use a single workbook to display data from all workspaces. What is the correct approach?
Quick Answer
The correct approach is to create a workbook with cross-workspace queries using the workspace() expression. This is the right choice because the workspace() expression allows you to specify multiple Log Analytics workspaces directly within a single KQL query, enabling a workbook to pull and aggregate data from different regional workspaces without needing to merge them or export data. On the SC-200 exam, this scenario tests your understanding of how Microsoft Sentinel handles multi-workspace architectures, often appearing as a trap where candidates mistakenly think you need to merge workspaces or use separate workbooks. The common pitfall is assuming a workbook can only query one workspace, but the workspace() expression is designed precisely for this distributed query pattern. Remember the memory tip: “One workbook, many workspaces—workspace() is your bridge.”
⚠ Common exam trap
It's easy for candidates to confuse Azure Lighthouse (which is for cross-tenant management) with cross-workspace querying, or assume that data must be centralized (e.g., via Data Lake) before it can be visualized in a single workbook.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a workbook with cross-workspace queries using the workspace() expression
Microsoft Sentinel workbooks support cross-workspace queries using the `workspace()` expression in Kusto Query Language (KQL). This allows a single workbook to aggregate and display data from multiple Sentinel workspaces without moving or duplicating the data, meeting the security team's requirement efficiently.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a workbook with cross-workspace queries using the workspace() expression
Why this is correct
Cross-workspace queries allow a single workbook to query multiple workspaces.
- ✗
Export data from all workspaces to a single Azure Data Lake
Why it's wrong here
Exporting is unnecessary; workbooks support cross-workspace queries.
- ✗
Create a workbook in one workspace and configure it to use Azure Lighthouse
Why it's wrong here
Lighthouse is for management, not for cross-workspace queries in workbooks.
- ✗
Create a workbook in each workspace and merge them manually
Why it's wrong here
Manual merging is inefficient.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel and has multiple workspaces for different business units. You need to enable cross-workspace querying for the security operations center (SOC) analysts. What should you do?
hard- A.Configure a data connector for each workspace
- ✓ B.Use the workspace() expression in KQL queries
- C.Enable incident merging across workspaces
- D.Create a single workspace and migrate all data
Why B: The `workspace()` expression in KQL allows a query to reference tables from multiple Log Analytics workspaces within a single query. This enables SOC analysts to perform cross-workspace queries without moving data, which is the correct approach for a multi-workspace Sentinel deployment.
Variation 2. Your SOC uses Microsoft Sentinel with multiple workspaces for different business units. You want to create a single dashboard that shows key performance indicators (KPIs) across all workspaces. Which approach minimizes complexity and query latency?
hard- A.Export data to Azure Data Explorer and build the dashboard there.
- B.Ingest all logs into a single workspace and create the dashboard there.
- C.Use Power BI to query each workspace separately and combine data.
- ✓ D.Use cross-workspace queries in a single dashboard that references all workspaces.
Why D: Cross-workspace queries in Microsoft Sentinel allow you to query multiple workspaces in a single KQL query using the `workspace()` expression, enabling a unified dashboard without data duplication or additional infrastructure. This minimizes complexity by avoiding data movement and reduces query latency by leveraging the existing indexing and caching within each workspace.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.