Geographical availability and data residency in Microsoft Sentinel

When you set up Microsoft Sentinel or prepare for compliance checks, you need the ability to validate and prove who has access to what data in your environment. In this article, you learn where Microsoft Sentinel data is stored so you can meet compliance requirements.

Why geographical availability and data residency is important

After your data is collected, stored, and processed, compliance can become an important design requirement, with a significant impact on your Microsoft Sentinel architecture. Having the ability to validate and prove who has access to what data under all conditions is a critical data sovereignty requirement in many countries and regions, and assessing risks and getting insights in Microsoft Sentinel workflows is a priority for many customers.

Learn more about compliance considerations.

Where Microsoft Sentinel data is stored

Microsoft Sentinel is a non-regional service. However, Microsoft Sentinel is built on top of Azure Monitor Logs, which is a regional service. Note that:

• Microsoft Sentinel can run on workspaces in these supported regions.
• Regions where Log Analytics is newly available may take some time to onboard the Microsoft Sentinel service.
• Microsoft Sentinel stores customer data in the same geography as the Log Analytics workspace associated with Microsoft Sentinel.
• Microsoft Sentinel processes customer data in one of two locations:
  • If the Log Analytics workspace is located in Europe, customer data is processed in Europe.
  • For all other locations, customer data is processed in the US
• While Microsoft Sentinel is accessible in both the Microsoft Defender and Azure portals, Microsoft Sentinel data is stored in Azure regions.

Supported regions

Microsoft Sentinel can run on workspaces in the following regions: