Microsoft
Microsoft
For 1), I don't think that is possible with AzSentinel. Tagging Pouyan Khabazi to take it as feedback
For 2) please read the following article about cross-workspace analytics rules: https://techcommunity.microsoft.com/t5/azure-sentinel/what-s-new-cross-workspace-analytics-rules/ba-p/1664211 . If the rule that you're defining doesn't contain intellectual property, our recommendation is to create the rule in the customer tenant. If you do need to protect your IP, then use each rule for a single customer, because it may be difficult to tell which customer was the alert triggered on and it will complicate investigation.
It is true that you will end up with a high number of rules, but with good naming convention and proper configuration management via infrastructure as code, this should not be a problem. Further more, you can define in the MSSP tenant a workspace for each target customer to streamline management.
Regards