You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/multiple-tenants-service-providers.md
+20-12Lines changed: 20 additions & 12 deletions
Original file line number
Diff line number
Diff line change
@@ -1,5 +1,5 @@
1
1
---
2
-
title: Work with multiple tenants to Azure Sentinel for MSSP service providers| Microsoft Docs
2
+
title: Work with multiple tenants to Azure Sentinel for MSSP service providers| Microsoft Docs
3
3
description: How to work with multiple tenants to Azure Sentinel for MSSP service providers.
4
4
services: sentinel
5
5
documentationcenter: na
@@ -13,33 +13,41 @@ ms.devlang: na
13
13
ms.topic: conceptual
14
14
ms.tgt_pltfrm: na
15
15
ms.workload: na
16
-
ms.date: 09/23/2019
16
+
ms.date: 09/29/2020
17
17
ms.author: yelevin
18
18
19
19
---
20
-
# Work with multiple tenants in Azure Sentinel
20
+
# Manage multiple tenants in Azure Sentinel as an MSSP
21
21
22
-
If you're a managed security service provider (MSSP) and you're using [Azure Lighthouse](../lighthouse/overview.md) to manage your customers' security operations centers (SOC), you will be able to manage your customers' Azure Sentinel resources without connecting directly to the customer's tenant, from your own Azure tenant.
22
+
If you're a managed security service provider (MSSP) and you're using [Azure Lighthouse](../lighthouse/overview.md) to offer security operations center (SOC) services to your customers, you can manage your customers' Azure Sentinel resources directly from your own Azure tenant, without having to connect to the customer's tenant.
- For this to work properly, your tenant must be registered to the Azure Sentinel Resource Provider on at least one subscription. If you have a registered Azure Sentinel in your tenant, you are ready to get started. If not, select **Subscriptions** from the Azure portal, followed by **Resource providers**. Then, from the **SOC - Resource providers** screen, search for and select `Microsoft.OperationalInsights` and `Microsoft.SecurityInsights`, and select **Register**.
## How to access Azure Sentinel from other tenants
29
-
1. Under **Directory + subscription**, select the delegated directories, and the subscriptions where your customer's Azure Sentinel workspaces are located.
- For this to work properly, your tenant (the MSSP tenant) must have the Azure Sentinel resource providers registered on at least one subscription. In addition, each of your customers' tenants must have the resource providers registered. If you and your customers have registered Azure Sentinel in your tenant, you are ready to get started. To verify registration, take the following steps:
32
29
33
-
1. Open Azure Sentinel. You will see all the workspaces in the selected subscriptions, and you'll be able to work with them seamlessly, like any workspace in your own tenant.
30
+
1. Select **Subscriptions** from the Azure portal, and then select a relevant subscription from the menu.
34
31
35
-
> [!NOTE]
36
-
> You will not be able to deploy connectors in Azure Sentinel from within a managed workspace. To deploy a connector, you must directly sign into the tenant on which you want to deploy a connector and authenticate there with the required permissions.
32
+
1. From the navigation menu on the subscription screen, under **Settings**, select **Resource providers**.
33
+
34
+
1. From the ***subscription name* | Resource providers** screen, search for and select *Microsoft.OperationalInsights* and *Microsoft.SecurityInsights*, and check the **Status** column. If the provider's status is *NotRegistered*, select **Register**.
## How to access Azure Sentinel from other tenants
39
+
40
+
1. Under **Directory + subscription**, select the delegated directories, and the subscriptions where your customer's Azure Sentinel workspaces are located.
38
41
42
+
:::image type="content" source="media/multiple-tenants-service-providers/directory-subscription.png" alt-text="Choose tenants and subscriptions":::
39
43
44
+
1. Open Azure Sentinel. You will see all the workspaces in the selected subscriptions, and you'll be able to work with them seamlessly, like any workspace in your own tenant.
40
45
46
+
> [!NOTE]
47
+
> You will not be able to deploy connectors in Azure Sentinel from within a managed workspace. To deploy a connector, you must directly sign into the tenant on which you want to deploy a connector, and authenticate there with the required permissions.
41
48
42
49
## Next steps
50
+
43
51
In this document, you learned how to manage multiple Azure Sentinel tenants seamlessly. To learn more about Azure Sentinel, see the following articles:
44
52
- Learn how to [get visibility into your data, and potential threats](quickstart-get-visibility.md).
45
53
- Get started [detecting threats with Azure Sentinel](tutorial-detect-threats-built-in.md).
0 commit comments