Super Contributor

We are interested in knowing when a Managed Security Service Provider can use Azure Sentinel to manage multiple customer environments. Is this MSSP scenario something the engineering team is committed to?

7 Replies

@Eliav Levi or @Koby Koren: Is this something you can elaborate on at this time? 

Ditto! :)

Hi Joe - We are planning to support MSSP scenario soon. Stay tuned!

@Shalini Pasupneti Any updates on timeline for MSSP support?

That would be very interesting !
Hey, seems this thread is a little old, i was wondering if there is any news in this area?


I just saw this old question by @Joe Stocker and @Vartan_Andreev.  The answer to your question is 'yes'. The engineers were focussed on allowing MSSP's to manage multiple customers.


We are an MSSP in the NL and we use Azure Lighthouse ( to establish the connection between our Azure Sentinel workspace/tenant with the workspace/tenant of our customer. After our customer deploys the ARM template that we send to them, our Analysts and Engineers have 'Azure Sentinel Contributor' (built-in RBAC) among others permission in their workspace/tenant. From that moment we can define the monitoring rules, connect those to playbooks, create dashboards, ... There are still a couple of challenges for MSSP's for example, the intellectual property, but this is another question.