Microsoft announced on 20 October 2026 that cross-tenant delegated administration in Microsoft Defender is generally available. The capability extends delegated access to Microsoft Sentinel resources and uses Defender unified role-based access control to assign granular permissions to delegated users.
The change matters for managed security service providers and central security teams that operate across more than one Microsoft Entra tenant. It gives those teams a way to use home-tenant accounts for security operations, rather than creating local administrator accounts or Microsoft Entra B2B guest accounts in each tenant.
Governance relationship model
The feature uses the same governance relationship model as Microsoft Entra Tenant Governance. A governance relationship is directional. The governing tenant is the tenant where the MSSP or central security team manages analysts and security groups, while the governed tenant is the customer or organisational tenant that grants access.
After approval, selected security groups from the governing tenant appear in the governed tenant as remote tenant groups. The governed tenant then assigns supported roles and resource scopes to those groups. The governing tenant continues to manage group membership, so access changes can be made by adding or removing analysts from the relevant security groups.
This separates two controls. The governed tenant sets the boundary for delegated access. The partner or central team manages the people who work inside that boundary.
Consent and permissions
The relationship is established through a three-step consent process. First, the governed tenant enables governance invitations in Microsoft Defender and invites the governing tenant. Second, the governing tenant creates an access template with the relevant security groups and Microsoft Entra role assignments, then sends the request.
Third, the governed tenant approves or rejects the request and configures Defender and Sentinel roles and scopes for the remote tenant groups. Microsoft says the governed tenant retains final approval over delegated access.
For Microsoft Defender, administrators can assign supported Defender unified RBAC roles to remote tenant groups, including custom roles. For Microsoft Sentinel, customers can use Defender unified RBAC or Azure RBAC to assign the permissions needed for delegated operations.
Microsoft’s documentation distinguishes relationship-level permissions from workload-specific permissions. The governance relationship establishes the trust and identity foundation. Workload-specific assignments, such as Azure RBAC or Defender RBAC roles, are configured in the governed tenant after the relationship exists.
Requirements and setup details
Microsoft lists licensing requirements for both tenants. Each tenant needs at least one Microsoft Entra ID P1 licence. Each tenant also needs at least one Microsoft 365 E5 licence or Microsoft Sentinel enabled in Microsoft Defender.
The setup also requires specific administrator roles. A user in the governing tenant needs the Tenant Governance Relationship Administrator role. In the governed tenant, sending an invitation requires the Tenant Governance Administrator role.
Assigning permissions to a remote tenant group requires the User Access Administrator role in Azure RBAC and at least the User Administrator role in Entra RBAC. Microsoft also notes that the invitation setting is disabled by default and must be turned on in the governed tenant under System > Permissions > Delegated Access in the Microsoft Defender portal.
Security groups used for delegated access must meet Microsoft’s supported criteria. They must have the SecurityEnabled property set to true, the IsAssignableToRole property set to true, and they must not be Microsoft 365 groups.
Sentinel and Defender operations
The Sentinel support covers role assignments for work such as alert and incident management, threat intelligence, hunting, content distribution and direct management through the Defender portal. When Azure RBAC is used for Sentinel resource group permissions, Microsoft says those assignments grant management-plane access to selected resources. They do not automatically grant data-plane access, such as reading Azure Storage blob data or Azure Key Vault secrets.
The general availability follows the public preview that Microsoft described in March 2026 for non-Cloud Solution Provider organisations. At that point, Microsoft positioned the work as an extension of Granular Delegated Admin Privileges to Sentinel and Defender customers, including MSSPs and customers with multitenant structures.
Riley Boon, Senior Capability Engineer at CyberCX, said the ability to assign Azure RBAC and Defender unified RBAC to remote tenant groups over GDAP would allow the company to configure and access customer environments for managed security operations. Ryan Sturm, Senior Manager for Microsoft Security Engineering at BlueVoyant, said the improvements included support for assigning GDAP security groups to Sentinel workspace roles and unified RBAC support for GDAP remote tenant groups.
The operational effect is narrower than a full tenant management redesign, but it addresses a common access problem in multitenant security operations. It gives customers a consent-based model for granting specific access, while allowing partners and central teams to manage their analysts through groups in their own tenant.
Delegated access through remote tenant groups, Defender unified RBAC and Sentinel role assignments is the kind of control boundary ECS's Security topic examines, alongside Security Copilot, Zero Trust, Sentinel, Purview and DevSecOps. Sessions and workshops give attendees room to compare role design, tenant governance and operational practice with people who run these environments. Bring tenant access models and MSSP scenarios that are difficult to resolve from documentation alone.
Photo: Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons, cropped
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.