MSSP Automation Rule Permissions

%3CLINGO-SUB%20id%3D%22lingo-sub-2914363%22%20slang%3D%22en-US%22%3EMSSP%20Automation%20Rule%20Permissions%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2914363%22%20slang%3D%22en-US%22%3E%3CP%3EI%20recently%20saw%20the%20updates%20made%20to%20the%20permissions%20required%20to%20leverage%20the%20Automation%20Rules%20for%20MSSP%20providers%2Fcustomers%20as%20outlined%20here%3A%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fautomate-incident-handling-with-automation-rules%23permissions-for-automation-rules-to-run-playbooks%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fsentinel%2Fautomate-incident-handling-with-automation-rules%23permissions-for-automation-rules-to-run-playbooks%3C%2FA%3E%3CBR%20%2F%3E%3CBR%20%2F%3EIs%20it%20possible%20to%20have%20a%20playbook%20hosted%20in%20the%20customer's%20tenant%2C%20such%20as%20the%20Block-AAD%20playbook%2C%20and%20run%20it%20against%20rules%20configured%20in%20the%20service%20provider%20tenant%20with%20this%20model%3F%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3EIn%20the%20documentation%20it%20describes%20the%20opposite%20process%20-%20running%20playbooks%20hosted%20in%20the%20service%20provider%20tenant%20against%20customer%20tenants.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I recently saw the updates made to the permissions required to leverage the Automation Rules for MSSP providers/customers as outlined here: https://docs.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules#per...

Is it possible to have a playbook hosted in the customer's tenant, such as the Block-AAD playbook, and run it against rules configured in the service provider tenant with this model? 

In the documentation it describes the opposite process - running playbooks hosted in the service provider tenant against customer tenants.

0 Replies