Forum Discussion

AdamJones's avatar
AdamJones
Copper Contributor
Feb 06, 2021

Azure Sentinel Multi tenant/MSSP Playbooks

Hi,   Just to add some background before I ask the question.   We have about 8 customers that we have deployed a CSP Subscription and put Sentinel on. We have then used Lighthouse to grant us acc...
pavankemi's avatar
pavankemi
Brass Contributor
Feb 11, 2021
Hi, light house will help me out if i provide the list of resources name in the ARM template my question over here is as a shared resources i might be having 20 resources who will monitor the azure sentinel for various customer as part of shared srrvice. 1 resource might be providing service to multiple customers. Now i cannot request customer to create these 20 resources in their Azure AD. So what woild be the work around for this
  • mperrotta's avatar
    mperrotta
    Brass Contributor
    Feb 17, 2021

    Javier-Soriano We are trying to do something similar as AdamJones. We have Lighthouse setup to manage our clients workspaces and have some Playbooks we would like consistent across our workspaces, such as being able to send email alerts from an incident.

     

    We have noticed that we can attach playbooks that are created under other organizations but we cannot attach any playbooks that are within the MSSP tenant, they just don't appear in the list. We do have the subscription selected, that should not be the issue there.

     

    The only explanation I can think of is that we have to onboard ourselves into Lighthouse, if that is even possible.

     

    Any insight here would be helpful.

     

    Thanks,

    Mike

    • Javier-Soriano's avatar
      Javier-Soriano
      Icon for Microsoft rankMicrosoft
      Feb 17, 2021

      mperrotta you should be able to select a playbook in the MSSP tenant as an automatic response to an analytics rule created in the customer tenant. If you don't see those playbooks, it could be because you're lacking permissions to see the resource group where the playbooks are located or because you don't have a Logic App role granted in the MSSP tenant (or both!)

      • mperrotta's avatar
        mperrotta
        Brass Contributor
        Feb 19, 2021

        Javier-Soriano Thanks, I finally found the role that was required, the Monitoring Reader ro

Resources