Status: IN
Log Analytics workspace configuration decisions (retention periods, table plans, DCR filtering) directly impact three product consumers — Azure Monitor, Microsoft Sentinel, and Microsoft Defender for Cloud — because the dual ingestion model (metrics time-series + Log Analytics workspace) feeds all three through the shared data platform; a misconfigured workspace degrades security observability, not just operational monitoring.