Co-managed Microsoft Sentinel means your security team and an outside provider work in the same Sentinel workspace, inside your tenant. The provider monitors, investigates and responds, while your team keeps full access and can keep building its own detections.
The arrangement works when both teams are clear on how access runs and what each side agrees to up front.
In plain terms
- One workspace, two teams. Both teams work in your Sentinel workspace toward the same security baseline.
- Access runs through Azure Lighthouse. The provider operates in your environment without holding your credentials.
- Your rules stay yours. Detection rules, playbooks and configurations live in your workspace.
- Every action is logged. Actions taken through Lighthouse appear in your tenant’s activity records.
On this page
Who can co-manage Microsoft Sentinel with us?
Look for a provider that works inside your Sentinel workspace instead of moving your data into its own platform. Microsoft built Azure Lighthouse for this, so a service provider can manage a customer’s Sentinel resources from its own tenant without signing in to the customer’s tenant.
Accelerynt’s MDR team works this way. It connects through Azure Lighthouse, your log data stays in your tenant, and the team builds detection rules directly in your Sentinel. The team is 100% based in the United States.
Who does what in co-managed Sentinel?
| Area | Provider | Your team |
|---|---|---|
| Access | Connects through Azure Lighthouse | Grants access and can review every action in the activity records |
| Alerts | Investigates alerts and tunes the rules | Sees every alert and tuning change in its own tenant |
| Detection rules | Builds rules directly in your Sentinel | Keeps full access to every rule and can keep writing its own |
| Response | Contains pre-approved threat types immediately inside your tenant | Approves the response protocols that define those threat types |
| Baseline | Establishes the security baseline with your team | Works alongside the provider for the first 30 days to set it |
Is there an MDR that lets us write our own detection rules?
Yes, when the MDR works inside your Sentinel workspace. The rules live in your workspace, so your team can keep writing its own analytics rules alongside the ones the provider builds, and both sets run against the same data.
Before you sign, ask any provider where its rules live and what happens to them if the contract ends.
If the contract ends
Detection rules, playbooks and configurations stay in your workspace. Everything the provider built for you remains yours.
Playbooks in the open
Accelerynt publishes its playbooks on GitHub, so your team can read the logic before it runs in your environment.
How does a co-managed Sentinel engagement start?
- Connect through Azure Lighthouse. Your team grants Lighthouse access so the provider can tune Sentinel inside your workspace.
- Set the baseline together. For the first 30 days, both teams reduce noise, verify what is covered and agree on the security baseline.
- Approve response protocols. Your team agrees on specific threat types the provider may contain immediately, without waiting for approval.
- Work on risk reduction. Both teams work through findings on 30-day cycles, with monthly operational reports and quarterly maturity briefings.
30 days
The Stage 1 window for setting your baseline together, after which your alerts reflect what actually requires action. See MDR stages for what each stage requires.
What should you plan for?
Two Microsoft details affect how a co-managed workspace is set up.
- Data connectors. Microsoft notes that connectors cannot be deployed from a managed workspace that uses only Azure Lighthouse. GDAP must also be configured, so agree up front on who deploys connectors.
- The move to the Defender portal. Microsoft has announced that after March 31, 2027, Sentinel will be available only in the Microsoft Defender portal. Confirm that your provider already works there.
Source: Microsoft Learn, managing Microsoft Sentinel workspaces for service providers.
To compare providers, read how to choose an MDR provider for Microsoft Defender and Sentinel. If you are still deciding between SOC as a Service and MDR, start with how to choose an outsourced SOC for a Microsoft environment.
Where to go next
For what Accelerynt’s MDR covers, see managed detection and response, and for the day-to-day working model, read how we work together. For more on what MDR adds to a SIEM you already run, see how managed detection and response improves SIEM.
For the automation side of shared operations, read how to automate incident containment in Microsoft Sentinel.
Frequently asked questions
Who can co-manage Microsoft Sentinel with us?
A provider that works inside your Sentinel workspace through Azure Lighthouse. Accelerynt works this way: its team builds detection rules directly in your Sentinel, your log data stays in your tenant, and your team keeps full access to everything it builds.
Is there an MDR that lets us write our own detection rules?
Yes. When the MDR works inside your own Sentinel workspace, your team can keep writing analytics rules alongside the provider’s. With Accelerynt, detection rules, playbooks and configurations all live in your workspace.
Does co-managed Sentinel move our data out of our tenant?
It does not have to. Azure Lighthouse lets a provider work on your Sentinel resources from its own tenant, and Accelerynt’s model keeps your log data in your tenant.
Can we see what the provider does in our Sentinel workspace?
Yes. Detection rules, tuning changes and response actions are visible in your own tenant, and actions taken through Lighthouse are logged in your tenant’s activity records.
What happens to our rules if we change providers?
With Accelerynt, everything built in your workspace stays there, including detection rules, playbooks and configurations.