MSSP Multi-Tenant Handling with Lighthouse and Defender XDR

Question

Hello,

As  far as I know an MSSP providers,  leverages Azure Lighthouse to call and access multiple customer workspaces, which allows to manage analytics across tenants.

My questions are:

In the case of moving to Defender XDR, how would this be possible in a multi-tenant MSSP scenario? Even with Lighthouse, how does Defender XDR avoid merging incidents/alerts across different customers when the same entities are involved? How does Defender XDR differentiate identical IOCs (same IP, hash, etc.) that appear in multiple customers? Can MSSPs customize correlation logic to prevent false cross-tenant merges?

Content Ownership & Sharing

Most MSSPs do not want to share their proprietary content (custom rules, detections, playbooks, analytics, etc.) with customers. How is Defender XDR approaching this requirement to ensure MSSPs can operate without exposing their intellectual property?

Example:

Customer Test 1 has a port scan incident from IP 10.10.10.10. Customer Test 2 also has a port scan incident from the same IP 10.10.10.10.

In Sentinel today, these would remain separate. But in Defender XDR, would these two alerts risk being merged into a single incident because the same entity is detected across tenants?

Thanks in advance for any clarification.

Answer 1

In a multi-tenant scenario with Microsoft Defender XDR, the platform is designed to maintain data isolation and prevent merging incidents or alerts across different customers, even when the same entities are involved. Each customer tenant retains ownership of its data, and Defender XDR is built to ensure that alerts related to identical Indicators of Compromise (IOCs), such as the same IP address or hash, are treated separately for each tenant. This means that incidents like the port scan from the same IP address for different customers would not be merged into a single incident, preserving the integrity of each customer's security data.

Furthermore, MSSPs can customize correlation logic within Defender XDR to help prevent false positives that might arise from cross-tenant merges. This capability allows MSSPs to tailor their security operations according to their specific requirements while ensuring that proprietary content, such as custom rules and analytics, remains confidential and is not exposed to customers.

Overall, Defender XDR aims to provide a robust framework for MSSPs to manage security across multiple tenants without compromising on data ownership or exposing sensitive intellectual property.

---

References:

• Microsoft 365 Lighthouse frequently asked questions (FAQs)
• Manage Microsoft Sentinel workspaces at scale