Cross-Workspace Incident Management — Using Azure Lighthouse for Unified View
Your organization uses Microsoft Sentinel with multiple workspaces across different regions. You need to centrally manage all security incidents from a single pane of glass. The solution must allow analysts to investigate incidents across workspaces without switching contexts. What should you configure?
Quick Answer
The answer is to configure Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel. This is correct because Azure Lighthouse provides centralized tenant management, allowing you to delegate and view incidents across disparate Sentinel workspaces from a single pane of glass without requiring analysts to switch contexts. On the SC-200 exam, this scenario tests your understanding of how to unify incident management across regions, often appearing as a trap where candidates confuse cross-workspace queries (which use KQL) with cross-workspace incident visibility. Remember that Azure Lighthouse handles the governance layer for multi-tenant or multi-workspace views, while Sentinel’s built-in cross-workspace incident view relies on this delegation. A helpful memory tip: think of Lighthouse as the “bridge” that connects your workspaces, so you can see all incidents in one place without jumping between portals.
⚠ Common exam trap
Many candidates confuse cross-workspace querying (Option B) with centralized incident management, not realizing that the workspace() expression only enables log queries, not the aggregated incident view required for a single pane of glass.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.
Azure Lighthouse enables cross-workspace incident management in Microsoft Sentinel by granting delegated access across multiple Azure tenants or regions. This allows analysts to view and investigate incidents from all connected workspaces in a single pane of glass without switching contexts, fulfilling the requirement for centralized incident management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy Microsoft Sentinel in a single region and use Azure Arc to connect other workspaces.
Why it's wrong here
Azure Arc is for server management, not Sentinel workspaces.
- ✗
Create a union query across workspaces using the workspace() expression.
Why it's wrong here
Union queries are for log queries, not incident management.
- ✓
Use Azure Lighthouse to manage multiple workspaces and enable cross-workspace incident view in Microsoft Sentinel.
Why this is correct
Azure Lighthouse allows managing multiple workspaces from a single view.
- ✗
Configure a single workspace and use diagnostic settings to send all logs to it.
Why it's wrong here
This would centralize data but not necessarily provide cross-workspace incident management.
Go deeper
Related to this question
About these practice questions
One of 209 original SC-200 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SC-200
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your organization uses Microsoft Sentinel with multiple workspaces. You need to ensure that incidents involving the same alert in different workspaces are automatically grouped into a single incident. What should you configure?
medium- A.Enable UEBA to correlate alerts across workspaces.
- B.Set up an automation rule to merge incidents.
- ✓ C.Create an analytics rule that runs across all workspaces.
- D.Configure an incident grouping rule in Microsoft Sentinel.
Why C: You can create a scheduled analytics rule that queries across multiple workspaces (using the workspace() function or union operator) and if the same alert appears in multiple workspaces, the rule can generate a single incident. This allows automatic grouping of correlated alerts from different workspaces into one incident. Option D is incorrect because Microsoft Sentinel does not have a dedicated 'incident grouping rule' that groups alerts from multiple workspaces; that feature does not exist.
Variation 2. Your organization uses Microsoft Sentinel with multiple workspaces. You need to create a unified incident queue across all workspaces. Which TWO solutions should you consider?
hard- A.Use cross-workspace queries in workbooks.
- ✓ B.Consolidate all data into a single Log Analytics workspace.
- ✓ C.Configure incident grouping rules in Microsoft Sentinel.
- D.Use Azure Policy to enforce workspace configuration.
- E.Deploy multiple playbooks to synchronize incidents.
Why B: Consolidating all data into a single Log Analytics workspace is the most straightforward and supported method to create a unified incident queue in Microsoft Sentinel. With a single workspace, all alerts and incidents are naturally aggregated, eliminating the need for cross-workspace synchronization. This approach simplifies management, ensures consistent analytics rules, and avoids the complexity of stitching incidents across multiple workspaces.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.