Azure Resource Graph Query - Retrieve details of all accessible Sentinel-enabled Operational Insights Workspaces

opinsights-all.kql

// This query retrieves all Microsoft Sentinel-enabled Log Analytics workspaces the user has access to.
// It checks for Sentinel by looking for the 'SecurityInsights' solution in 'Microsoft.OperationsManagement/solutions'.
// The join is done using the full resource ID of the workspace.

resources
| where type == "microsoft.operationalinsights/workspaces"
| extend workspaceId = tostring(properties.customerId), workspaceName = name, workspaceResourceId = tolower(id)
| join kind=leftouter (
    resources
    | where type == "microsoft.operationsmanagement/solutions"
    | where name startswith "SecurityInsights"
    | extend linkedWorkspaceId = tolower(tostring(properties.workspaceResourceId))
    | project linkedWorkspaceId, sentinelStatus = "Enabled"
) on $left.workspaceResourceId == $right.linkedWorkspaceId
| extend sentinelEnabled = iff(isnull(sentinelStatus), "Disabled", sentinelStatus)
| project workspaceId, workspaceName, subscriptionId, resourceGroup, location, tenantId, sentinelStatus