You operate three Microsoft Sentinel workspaces in different regions. You need a single SOC dashboard that shows incident counts by severity and sign-in failure trends across all workspaces, with a time range and workspace selector, and you must grant analysts read-only access without giving them write permissions to the workspaces. What two actions should you take?

Creating an Azure Monitor workbook with cross-workspace KQL queries is the correct approach because workbooks are designed for flexible, interactive dashboards that can aggregate data from multiple sources, including different Sentinel workspaces. Using workspace('WorkspaceName') and union allows you to combine data from all three workspaces, and parameters enable time range and workspace selection. Assigning the Log Analytics Reader role on each workspace grants the SOC group necessary read permissions for the logs, while the Reader role on the workbook itself allows them to view the dashboard without modifying the underlying workspaces. Pinning a blade to an Azure Dashboard only shows data from a single workspace, not aggregated data. Exporting to Power BI is an option but workbooks are native to Azure Monitor and better suited for real-time operational dashboards. Migrating to a single workspace is not feasible or recommended for existing, regionally distributed workspaces and would lose the benefits of regional data residency.