Microsoft Sentinel

Sap Audit Log Workbook

4 September 2026Doc update+0 / −5 lines

In brief

The page no longer includes guidance about the workbook’s hosting workspace or selecting a different SOC workspace when SOC data is stored elsewhere.

What Defender admins need to know

Administrators configuring SAP and SOC data across different workspaces will no longer find this guidance in the page; no required action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

The SAP - Security Audit log and Initial Access workbook installed in your Log Analytics workspace enabled for Microsoft Sentinel. For more information, see Visualize and monitor your data by using workbooks in Microsoft Sentinel.
At least one incident in your Microsoft Sentinel workspace, with at least one entry available in the SecurityIncident table. This doesn't need to be an SAP incident, and you can generate a demo incident using a basic analytics rule if you don't have another one.
If your Microsoft Entra data is in a different Log Analytics workspace, make sure you select the relevant subscriptions and workspaces at the top of the workbook, under Azure audit and activities.

Important
The SAP - Security Audit log and Initial Access workbook is hosted by the workspace where the Microsoft Sentinel solution for SAP applications were installed. By default, both the SAP and the SOC data is assumed to be on the workspace that hosts the workbook.

If the SOC data is on a different workspace than the workspace hosting the workbook, make sure to include the subscription for that workspace, and select the SOC workspace from Azure audit and activity workspace.

At least one incident in your Microsoft Sentinel workspace, with at least one entry available in the SecurityIncident table. This doesn't need to be an SAP incident, and you can generate a demo incident using a basic analytics rule if you don't have another one.

If your Microsoft Entra data is in a different Log Analytics workspace, make sure you select the relevant subscriptions and workspaces at the top of the workbook, under Azure audit and activities.

@@ -35,11 +35,6 @@ Before you can start using the **SAP - Security Audit log and Initial Access** w  - The **SAP - Security Audit log and Initial Access** workbook installed in your Log Analytics workspace enabled for Microsoft Sentinel. For more information, see [Visualize and monitor your data by using workbooks in Microsoft Sentinel](../monitor-your-data.md). -    > [!IMPORTANT]-    > The **SAP - Security Audit log and Initial Access** workbook is hosted by the workspace where the Microsoft Sentinel solution for SAP applications were installed. By default, both the SAP and the SOC data is assumed to be on the workspace that hosts the workbook.-    >-    > If the SOC data is on a different workspace than the workspace hosting the workbook, make sure to include the subscription for that workspace, and select the SOC workspace from **Azure audit and activity workspace**.- - At least one incident in your Microsoft Sentinel workspace, with at least one entry available in the `SecurityIncident` table. This doesn't need to be an SAP incident, and you can generate a demo incident using a basic analytics rule if you don't have another one.  - If your Microsoft Entra data is in a different Log Analytics workspace, make sure you select the relevant subscriptions and workspaces at the top of the workbook, under **Azure audit and activities**.