MC1457836 vs docs: Sentinel in unified RBAC with a service principal or GDAP. Which is it?

This is about the article https://learn.microsoft.com/en-us/defender-xdr/activate-defender-rbac, which states:

Assigning permissions to a service principal or to a GDAP user group in Microsoft Sentinel isn’t supported in unified RBAC. If you need either capability, don’t activate Sentinel in unified RBAC yet. Continue using Azure RBAC for Microsoft Sentinel.

Message center notice MC1457836 announces that Microsoft automatically enables unified RBAC on all tenants between late September and late December 2026, including Sentinel Reader, Responder and Contributor workspace permissions.

These two statements cannot both be followed. The article tells affected customers not to activate Sentinel; MC1457836 activates it for them.

This is not hypothetical for MSSPs. We operate a managed XDR service across roughly 25 customer tenants. Both unsupported capabilities are load-bearing in that model:

• A service principal holds Microsoft Sentinel Contributor through Azure Lighthouse and deploys analytics rules via ARM (Microsoft.OperationalInsights/workspaces/providers/alertRules).
• GDAP user groups are the standard delegated access route for partners.

Could this be clarified:

1. Does the service principal and GDAP limitation also apply to tenants activated through the MC1457836 automatic rollout, or does that path behave differently?
2. If it does apply, what is the recommended action for tenants that are auto-activated before the limitation is lifted? Is deactivating the Sentinel workload after activation the supported mitigation, and is it expected to fully restore Azure RBAC behaviour for a service principal?
3. Can a tenant be excluded from automatic Sentinel activation in advance, rather than only opting out afterwards?
4. The article also warns that changing permissions in the Azure portal after Sentinel is active in unified RBAC may cause sync errors. For Lighthouse-delegated permissions, which are managed outside the customer tenant entirely, is that a supported configuration once Sentinel is active?

A note in the “Before you begin” section describing how this limitation interacts with the automatic rollout would help partners decide whether to pre-emptively opt out.