An organization needs to collect Azure diagnostic logs for resources deployed across two distinct regulatory jurisdictions (Europe and the US). The requirements are:
1. Europe diagnostic logs must remain resident in Europe.
2. US diagnostic logs must remain resident in the US.
3. Access to the logs must be granted to the security team using the most scalable and maintainable administrative model.
Which two configurations should you include in the monitoring and governance design?
- Deploy separate Log Analytics workspaces in the Europe and US regions.Answer
- Assign the Monitoring Reader role to a Microsoft Entra group containing the security team members.Answer
- CDeploy a single centralized Log Analytics workspace in the East US region to store all logs.
- DAssign the Monitoring Reader role directly to the individual user accounts of each security team member.
- EConfigure an Azure Policy with a Deny effect to automatically deploy diagnostic settings for all new resources.
Answer
To satisfy the regional data residency requirements, you must deploy separate Log Analytics workspaces in Europe and the US. To manage security permissions scaleably, you should assign the Monitoring Reader role to a Microsoft Entra ID group rather than individual users.
Deploying separate Log Analytics workspaces in the Europe and US regions ensures that diagnostic logs do not leave their respective geographical boundaries, fulfilling the regional residency requirement. Assigning the Monitoring Reader role to a Microsoft Entra group simplifies administrative management by allowing permissions to be updated through group membership rather than individual role assignments.
Step-by-Step Solution
Key Concept
Designing regional log routing architecture and scalable access control for Azure Monitor Log Analytics.
Estimated Time:1m 30s