How to ingest Windows Event Logs from Tenant B's WEC (native Azure VM) to Tenant A?

Question

How to ingest Windows Event Logs from Tenant B's WEC (native Azure VM) to Tenant A?

Dominador Razon 0

We've deployed lighthouse on Tenant B to give permission on Tenant A's Admin.

We have a DCR that is already there associated with our on prem WEC and that's ingesting logs to WindowsEvent Table.

We have successfully associated Tenant B's WEC to our DCR in Tenant A, but there is no log ingestion happening from Tenant B. As I observed, The runtime settings on WEC is empty. It seems it could not download the DCR settings.

Copilot suggests to place the DCR in Tenant B and point the destination to Log Analytics Workspace in Tenant A.

Will that work?

0 comments

2 answers

Your answer

Answer 1

Hi @Dominador Razon

Yes, cross-tenant ingestion with AMA/DCR is supported when Azure Lighthouse is configured, but I would not immediately move the DCR to Tenant B.

Microsoft documents that a DCR can collect from machines across subscriptions/tenants and send to a Log Analytics workspace in another tenant when Azure Lighthouse is enabled. The DCR should be in the same region as the destination Log Analytics workspace.

Since your Tenant B WEC is successfully associated but the AMA runtime configuration is empty, the first thing I would investigate is the DCR association/configuration retrieval rather than ingestion itself.

I would verify:

AMA and Azure Arc agent are healthy and up to date on the Tenant B WEC.

The DCRA on the Tenant B Arc resource references the correct DCR resource ID.

The Lighthouse delegation includes sufficient permissions to manage the DCR/DCRA.

If you use a DCE, verify that the WEC is correctly associated with the appropriate configuration access endpoint.

Check the AMA logs for DCR download/configuration errors.

Regarding Copilot's suggestion: a DCR in Tenant B pointing to the Log Analytics workspace in Tenant A can also be a valid cross-tenant design with Lighthouse, provided the permissions and regional requirements are satisfied. However, it should not be necessary simply because the source WEC is in Tenant B.

So I would first troubleshoot why the existing cross-tenant DCR association is not being downloaded by AMA before redesigning the architecture.

If this helps resolve your issue, please don’t forget to mark the answer as Accepted / Resolved.

Answer 2

Just an update.
This works when you put the DCR on Tenant B. Since the WEC is in Tenant B, the setup aligns to MS statement below.

*Microsoft documents that a DCR can collect from machines across subscriptions/tenants and send to a Log Analytics workspace in another tenant when Azure Lighthouse is enabled. The DCR should be in the same region as the destination Log Analytics workspace.

*The rationale: the WEC VM in Tenant B uses a managed identity that the DCR in Tenant A could not recognize so the authentication fails. When we moved the DCR to Tenant B, it is able to authenticate the managed identity of the WEC VM allowing the DCR settings to be downloaded and applied. Then the ingestion flow to Tenant A's Log Analytics Workspace.