MSSP

%3CLINGO-SUB%20id%3D%22lingo-sub-358448%22%20slang%3D%22en-US%22%3EMSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358448%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20interested%20in%20knowing%20when%20a%20Managed%20Security%20Service%20Provider%20can%20use%20Azure%20Sentinel%20to%20manage%20multiple%20customer%20environments.%20Is%20this%20MSSP%20scenario%20something%20the%20engineering%20team%20is%20committed%20to%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358659%22%20slang%3D%22en-US%22%3ERE%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358659%22%20slang%3D%22en-US%22%3EHi%20Joe%20-%20We%20are%20planning%20to%20support%20MSSP%20scenario%20soon.%20Stay%20tuned!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358631%22%20slang%3D%22en-US%22%3ERe%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358631%22%20slang%3D%22en-US%22%3E%3CP%3EDitto!%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-358605%22%20slang%3D%22en-US%22%3ERe%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-358605%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F222671%22%20target%3D%22_blank%22%3E%40Eliav%20Levi%3C%2FA%3E%20or%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F187254%22%20target%3D%22_blank%22%3E%40Koby%20Koren%3C%2FA%3E%3A%20Is%20this%20something%20you%20can%20elaborate%20on%20at%20this%20time%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-536137%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-536137%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F16203%22%20target%3D%22_blank%22%3E%40Shalini%20Pasupneti%3C%2FA%3E%26nbsp%3BAny%20updates%20on%20timeline%20for%20MSSP%20support%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-859748%22%20slang%3D%22de-DE%22%3ERe%3A%20RE%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-859748%22%20slang%3D%22de-DE%22%3EThat%20would%20be%20very%20interesting%20!%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1349629%22%20slang%3D%22en-US%22%3ERe%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1349629%22%20slang%3D%22en-US%22%3EHey%2C%20seems%20this%20thread%20is%20a%20little%20old%2C%20i%20was%20wondering%20if%20there%20is%20any%20news%20in%20this%20area%3F%3CBR%20%2F%3E%3CBR%20%2F%3Ethanks%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1349697%22%20slang%3D%22en-US%22%3ERe%3A%20MSSP%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1349697%22%20slang%3D%22en-US%22%3E%3CP%3EI%20just%20saw%20this%20old%20question%20by%20%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F5941%22%20target%3D%22_blank%22%3E%40Joe%20Stocker%3C%2FA%3E%20and%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F642770%22%20target%3D%22_blank%22%3E%40Vartan_Andreev%3C%2FA%3E.%26nbsp%3B%20The%20answer%20to%20your%20question%20is%20'yes'.%20The%20engineers%20%3CU%3Ewere%3C%2FU%3E%20focussed%20on%20allowing%20MSSP's%20to%20manage%20multiple%20customers.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20are%20an%20MSSP%20in%20the%20NL%20and%20we%20use%20Azure%20Lighthouse%20(%3CA%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fservices%2Fazure-lighthouse%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fazure.microsoft.com%2Fen-us%2Fservices%2Fazure-lighthouse%2F%3C%2FA%3E)%20to%20establish%20the%20connection%20between%20our%20Azure%20Sentinel%20workspace%2Ftenant%20with%20the%20workspace%2Ftenant%20of%20our%20customer.%20After%20our%20customer%20deploys%20the%20ARM%20template%20that%20we%20send%20to%20them%2C%20our%20Analysts%20and%20Engineers%20have%20'Azure%20Sentinel%20Contributor'%20(built-in%20RBAC)%20among%20others%20permission%20in%20their%20workspace%2Ftenant.%20From%20that%20moment%20we%20can%20define%20the%20monitoring%20rules%2C%20connect%20those%20to%20playbooks%2C%20create%20dashboards%2C%20...%20There%20are%20still%20a%20couple%20of%20challenges%20for%20MSSP's%20for%20example%2C%20the%20intellectual%20property%2C%20but%20this%20is%20another%20question.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Super Contributor

We are interested in knowing when a Managed Security Service Provider can use Azure Sentinel to manage multiple customer environments. Is this MSSP scenario something the engineering team is committed to?

7 Replies
Highlighted

@Eliav Levi or @Koby Koren: Is this something you can elaborate on at this time? 

Highlighted

Ditto! :)

Highlighted
Hi Joe - We are planning to support MSSP scenario soon. Stay tuned!
Highlighted

@Shalini Pasupneti Any updates on timeline for MSSP support?

Highlighted
That would be very interesting !
Highlighted
Hey, seems this thread is a little old, i was wondering if there is any news in this area?

thanks
Highlighted

I just saw this old question by @Joe Stocker and @Vartan_Andreev.  The answer to your question is 'yes'. The engineers were focussed on allowing MSSP's to manage multiple customers.

 

We are an MSSP in the NL and we use Azure Lighthouse (https://azure.microsoft.com/en-us/services/azure-lighthouse/) to establish the connection between our Azure Sentinel workspace/tenant with the workspace/tenant of our customer. After our customer deploys the ARM template that we send to them, our Analysts and Engineers have 'Azure Sentinel Contributor' (built-in RBAC) among others permission in their workspace/tenant. From that moment we can define the monitoring rules, connect those to playbooks, create dashboards, ... There are still a couple of challenges for MSSP's for example, the intellectual property, but this is another question.