To hunt across multiple subscriptions/workspaces from a single Microsoft Sentinel workspace, you don't need to re-ingest data; you can query it where it already lives using cross-workspace queries . In KQL, this is done with the workspace() expression combined with union to stitch results from several workspaces in one result set (for example: union workspace( ' WS1 ' ).SecurityEvent, workspace( ' WS2 ' ).SecurityEvent ... ). This approach is the supported method for hunting across many projects/subscriptions while keeping data in its original Log Analytics workspaces, and it avoids duplicating ingestion or moving data. In addition, to integrate those remote workspaces with Sentinel features and ensure consistent schema/solution components, you add the Microsoft Sentinel solution to each workspace you want to include. Installing the solution enables Sentinel's content pack, schemas, and permissions model on those workspaces so they can fully participate in Sentinel scenarios while you run cross-workspace hunts from your central workspace. Therefore: (B) Create a query that uses the workspace expression and the union operator and (E) Add the Azure Sentinel solution to each workspace .