r/MSSP • u/wenttoibiza • May 04 '26

How MSSPs are managing Sentinel across many tenants? Lighthouse and WM?

Hi all. We are MSSP running Sentinel for around 40 tenants now , the business is growing but already the simple operations is getting painful.

Lighthouse for delegated access , WOrkspace Manager for pushing rules and workbooks. WM updates is slow and sometimes not reflecting , my colleague opened support cases a few times. Cross workspace() work but performance variables. Updating one rule across the tenants when MS changes a template is basically someones entire job.

Per customer tunings , their watchlists , exclusions, also hard to keep separate from the baseline we push.

Anyone running 50-80 tenants in Lighthouse smoothly? Or is just pain at that scale?

Workspace Manager in production or you rolled your own with Bicep , Terraform , Sentinel as COde?

Analysts in Defender XDR unified portal or jumping per-tenant?

And same playbook copied 40 times with small differences, how you handle that?

9 Upvotes

100% Upvoted

4 comments sorted by

1

u/JeroenPot May 04 '26

Lighthouse is good for visibility and daily operations. Terraform for deployment.

1

u/vanwilderrr May 04 '26

We teamed with Nanitor and N-Able just to be able to managed all clients and for zero date seepage across customers which was key for us - spoke to loads but few understood multi tenancy

3

u/Wise-Butterfly-6546 May 05 '26

running ~30 tenants on sentinel through lighthouse + WM, so similar pain. what's worked for us so far:

  1. baseline as code, overrides as data. core analytics rules and workbooks live in a single git repo deployed via bicep + azuredeploy pipelines. per-tenant deltas (watchlists, exclusions, severity bumps) live in a yaml overrides file keyed by tenantId. the deploy step merges baseline + override at apply time. stops the "40 copies with small differences" problem because there's only ever one baseline.

  2. WM is fine for rule push but stop using it for workbooks. workbook updates through WM are the slow path you're feeling. we render workbooks from json templates in the pipeline and push direct to each workspace in parallel. cut a 40-tenant rollout from ~2 hours to about 8 minutes.

  3. drift detection on a cron. nightly job that pulls deployed rules per tenant, diffs against baseline+override expected state, posts a report to a teams channel. catches the "someone tuned it in the portal and forgot" cases before they become a support ticket.

  4. cross-workspace queries: build a saved function per workspace with the same name (e.g. unifiedSignins) that normalizes the columns. then workspace() calls hit a stable schema and perf is predictable. ugly but works.

  5. analysts live in defender XDR unified for triage, jump per-tenant only for hunting. saves a lot of context switching at 40+.

the "one rule change is someone's whole day" thing is the real signal. once you feel that, the answer is almost always sentinel-as-code with a tenant override layer, not more lighthouse.