You need to ensure that you can run hunting queries to meet the Microsoft Sentinel...

Microsoft Sentinel is built on top of Azure Monitor Log Analytics . All Sentinel data — including security alerts, incidents, and telemetry from connected sources — is stored and queried thr ough a Log Analytics workspace . Sentinel’s hunting feature uses Kusto Query Language (KQL) , which runs directly against the Log Analytics workspace data.

Official Sentinel documentation specifies:

“Microsoft Sentinel uses an Azure Monitor Log Analytics wor kspace as its foundation. All data collected by Sentinel is stored in that workspace, and hunting queries run on this data.”

Other workspace types such as Azure Synapse , Azure Databricks , or Azure Machine Learning are for analytics, data science, and model ing — not security log collection or KQL-based hunting.

✅ Therefore, to run hunting queries in Microsoft Sentinel, you must create a Log Analytics workspace.