Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This article explains how to configure governance relationships for multitenant organizations and managed security service providers (MSSPs) to manage delegated access to customer tenants through the Microsoft Defender portal.
Important
This feature is currently in preview.
Overview
Governance relationships enable governing tenants (the home tenants that manage access) to manage security operations across multiple customer tenants (the tenants that grant delegated access) with fine-grained role assignments. This capability supports multitenant organizations (MTOs) and managed security service providers (MSSPs) that need to provide security services across multiple Microsoft Entra tenants.
Governance relationships for Microsoft Defender use the same model as Microsoft Entra ID for delegating administrative access, but extended to support Microsoft Defender XDR workloads. By configuring governance relationships for Microsoft Defender, you can assign specific security roles to groups in the governing tenant, allowing them to manage security incidents, alerts, and configurations in the governed tenant without granting full administrative access.
Key concepts
- Governing tenant: The home tenant that manages access to other tenants (also called home tenant or managing tenant)
- Governed tenant: The customer tenant that grants access to the governing tenant (also called target tenant or managed tenant)
- Governance relationship: directional connection between two Microsoft Entra tenants. One tenant acts as the governing tenant, and the other acts as the governed tenant.
- CSP: Cloud Solution Provider - Microsoft partners who sell cloud services
Prerequisites
Before you configure delegated access, ensure you meet the following requirements:
Licenses:
- Both tenants require at least one Microsoft Entra ID P1 license.
- Both tenants require at least one Microsoft 365 E5 license or Microsoft Sentinel enabled in Microsoft Defender.
Permissions:
- A user with the Tenant Governance Relationship Administrator role in the governing tenant.
- To send an invitation from the governed tenant, the user must have the Tenant Governance Administrator role.
- To assign permissions to a remote tenant group, the user must have the User Access Administrator role in Azure RBAC and at least a User Administrator role in Entra RBAC.
Enable tenant governance settings
Before you can configure delegated access, you must enable the governed tenant to receive governance invitations. This setting is disabled by default.
In the governed tenant in the Microsoft Defender portal, go to System > Permissions > Delegated Access, and turn on the Enable invitations toggle.
Set up delegated access
The tenant governance setup process involves three steps: the governed tenant sends an invitation, the governing tenant creates and sends an access request, and the governed tenant approves the request.
Step 1: Send invitation from governed tenant
The governed tenant initiates the relationship by sending an invitation to the governing tenant.
In the governed tenant, sign in to the Microsoft Defender portal.
Navigate to System > Permissions > Delegated Access.
Select Send invitation.
Enter the tenant ID of the governing tenant that you want to invite.
Select Send to send the invitation.
Step 2: Create and send access request from governing tenant
After it receives the invitation, the governing tenant creates a relationship template that defines delegated access permissions.
In the governing tenant, sign in to the Microsoft Defender MTO portal.
Navigate to System > Delegated Access.
Select Create access template.
Define the access template with the following information:
- Template name: A descriptive name for this access template
- Microsoft Entra built-in roles: Select one or more roles to assign
- Security groups: Select security groups from your governing tenant that will receive the assigned roles
Select Send relationship request.
Select the governed tenant that invited you, then select Submit.
Step 3: Approve access request in governed tenant
The governed tenant administrator reviews and approves the delegated access request.
In the governed tenant, sign in to the Microsoft Defender portal.
Navigate to System > Permissions > Microsoft XDR permissions.
Review the pending access request and select Approve or Reject.
After approval, you'll see a confirmation message.
After the approval is complete, users in the specified security groups receive permissions in the governed tenant based on the defined roles.
Configure tenant governance permissions for Microsoft Sentinel
Security groups used in the relationship template are synchronized to the governed tenant as "remote tenant groups." You can assign these groups to Microsoft Sentinel roles in the governed tenant to enable multitenant management capabilities. You can assign these groups to Azure Resource Manager (ARM) resources to enable Microsoft Sentinel management capabilities.
Assigning Microsoft Sentinel roles enables multitenant management features including:
- Alert and incident management
- Threat intelligence
- Hunting
- Content distribution
- Direct management through the Defender portal
Assign permissions to resource group
Before you assign permissions, ensure you have the User Access Administrator role in Azure RBAC and at least the User Administrator role in Entra RBAC.
Follow these steps to grant Microsoft Sentinel permissions to your delegated access groups.
In the governed tenant, sign in to the Azure portal.
Navigate to your resource group.
Select Access Control (IAM).
Select Add > Add role assignment.
Select the Microsoft Sentinel role you want to assign (for example, Microsoft Sentinel Contributor).
On the Members tab, under Assign access to, select Remote tenant group.
Select the synchronized security groups from the governing tenant.
Select Review + assign to complete the assignment.
Troubleshooting
Use the following guidance to resolve common issues when configuring governance relationships.
Security group not displayed when creating a template
Symptom: Your security group doesn't appear in the list when creating a relationship template.
Cause: Only security groups that meet specific criteria are supported for governance relationships delegation.
Resolution: Ensure your security group meets the following requirements:
- SecurityEnabled property is set to true
- IsAssignableToRole property is set to true
- Not a Microsoft 365 group (unified group)
Security groups that don't meet these criteria aren't supported for governance relationships delegation.