Hello @Diego Rios,
Please note that one of the main Pre-requisites for deploying Microsoft Sentinel is to have a Resource group.
Prerequisites
- A Log Analytics workspace is required to house the data that Microsoft Sentinel ingests and analyzes for detections, analytics, and other features. For more information, see Design a Log Analytics workspace architecture.
- The Log Analytics workspace must not have a resource lock applied, and the workspace pricing tier must be pay-as-you-go or a commitment tier. Log Analytics legacy pricing tiers and resource locks aren't supported when enabling Microsoft Sentinel. For more information about pricing tiers, see Simplified pricing tiers for Microsoft Sentinel.
- To reduce complexity, we recommend a dedicated resource group for your Log Analytics workspace enabled for Microsoft Sentinel. This resource group should only contain the resources that Microsoft Sentinel uses, including the Log Analytics workspace, any playbooks, workbooks, and so on. A dedicated resource group allows for permissions to be assigned once, at the resource group level, with permissions automatically applied to dependent resources. With a dedicated resource group, access management of Microsoft Sentinel is efficient and less prone to improper permissions. Reducing permission complexity ensures users and service principals have the permissions required to complete actions and makes it easier to keep less privileged roles from accessing inappropriate resources. Implement extra resource groups to control access by tiers. Use the extra resource groups to house resources only accessible by groups with higher permissions. Use multiple tiers to separate access between resource groups even more granularly.
Reference document: Prerequisites for deploying Microsoft Sentinel | Microsoft Learn
Please note that if you already have an existing Resource group created for the old deployment to enable Jamf Protect for Microsoft Sentinel integration which is not yet deleted, you can still use the same Resource group for the new configuration for a new deployment to enable Jamf Protect for Microsoft Sentinel integration.
If you don't have any Resource groups in your tenant, please refer to the below document for the detailed guide to create a new Resource group.
I hope this above information provided is helpful. Please feel free to reach out if you have any further questions.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".