Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove resource lock for workspace #940

Closed
jayhaddad opened this issue Mar 27, 2024 · 1 comment · Fixed by #941
Closed

Remove resource lock for workspace #940

jayhaddad opened this issue Mar 27, 2024 · 1 comment · Fixed by #941
Assignees

Comments

@jayhaddad
Copy link
Contributor

jayhaddad commented Mar 27, 2024

Benefit/Result/Outcome

Sentinel-linked workspaces cannot have a resource lock. https://learn.microsoft.com/en-us/azure/sentinel/best-practices-workspace-architecture#technical-best-practices-for-creating-your-workspace.

https://learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics#prerequisites (This is the feature of sentinel that doesn't like resource locks)

https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks

From docs page:

A read-only lock on a Log Analytics workspace prevents User and Entity Behavior Analytics (UEBA) from being enabled.

A cannot-delete lock on a Log Analytics workspace doesn't prevent [data purge operations

Description

Remove resource lock to ensure workspace falls in line with guidance.

Acceptance Criteria

@jayhaddad jayhaddad self-assigned this Mar 27, 2024
@jayhaddad jayhaddad changed the title Remove resource lock for a sentinel-linked workspace Remove resource lock for workspace Mar 27, 2024
@jamasten jamasten linked a pull request Mar 28, 2024 that will close this issue
4 tasks
@jamasten
Copy link
Contributor

This fix was implemented with PR #941

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants