Microsoft Defender Cross-Tenant Access Is Generally Available

Microsoft announced general availability of cross-tenant delegated administration in Microsoft Defender on October 20, 2026. The capability extends Microsoft Entra governance relationships into Defender and Microsoft Sentinel, so a customer or central security team can manage multiple tenants through approved groups and narrowly assigned roles.

For managed security providers and organizations with subsidiaries, regions, or separate business tenants, the practical change is a governed path for security operations across tenant boundaries. Analysts can work from their home tenant identity; each customer tenant still decides which groups, roles, and resources receive access.

What the GA announcement adds

This is a security-operations extension to Entra Tenant Governance, not a new blanket trust between tenants. Microsoft says the same governance relationship model applies across Entra, Defender, and Sentinel, while each governed tenant retains the final say over delegated permissions.

How the approval flow works

1. The customer or governed tenant invites the security team. A tenant administrator enables governance invitations in Microsoft Defender and sends an invitation to the governing tenant.
2. The governing tenant requests specific access. The central team creates a relationship template with the security groups and roles its analysts need, then sends the request.
3. The governed tenant reviews and approves. Its administrator checks the requested groups, roles, and resource scopes, then approves or rejects the relationship.
4. Workload permissions are assigned. The tenant owner configures Defender roles and Sentinel workspace permissions for the remote tenant groups using the supported RBAC model.

That division keeps ownership clear: the customer defines the access boundary, while the central or partner team maintains its own group membership as analysts join or leave.

Use the rollout to reduce standing access carefully

Start with a tenant-by-tenant access map. List the security work each team performs, the data and actions it needs, and the existing identities or delegated arrangements involved. Then design groups around work such as alert triage, incident investigation, threat hunting, and configuration changes instead of assigning a broad administrator role to every analyst.

• Separate read and response duties. Give analysts the ability to investigate before granting actions that change policies, devices, or incidents.
• Scope Sentinel deliberately. Assign workspace-level permissions where possible and document which Azure RBAC or Defender unified RBAC roles support each workflow.
• Test with a real analyst account. Verify the correct tenants, alerts, incidents, and workspaces appear, and confirm restricted actions remain unavailable.
• Keep customer approval visible. Store the approved relationship, role map, scope, owner, and review date with the security operations runbook.
• Plan joiner and leaver controls. Remove analysts from the governing security group promptly and review the governed tenant's role assignments on a set cadence.

Check the documentation before a production rollout

Microsoft's October 20 post confirms general availability. At review time, the Microsoft Learn setup guide still labels the feature as a preview and carries an earlier update date. That documentation lag does not override the GA announcement, but it means administrators should verify the current portal workflow, eligibility, and licensing before setting a rollout date.

Organizations already using Entra Tenant Governance can reuse their governance planning, but Defender and Sentinel still need workload-specific roles, scopes, and validation. See our broader Entra Tenant Governance guide for the tenant inventory and relationship operating model.

Frequently asked questions

Does general availability grant partners access automatically? No. Each governed tenant must enable invitations, review the relationship request, and approve the roles and resource scopes it is willing to grant.

Which security workloads are covered? Microsoft announced delegated access for Microsoft Defender and Microsoft Sentinel resources. Defender unified RBAC roles can be assigned for Defender; Sentinel access can use Defender unified RBAC or Azure RBAC.

Who is this for? Microsoft names managed security service providers, including non-CSP partners, and organizations operating multiple related tenants.

Do analysts need separate guest or administrator accounts in every customer tenant? The announced model lets analysts use their home-tenant identities and security groups, within permissions approved by each governed tenant. This can reduce the need for separate local administrator identities or Entra B2B guest accounts.

Why does Microsoft Learn still call the setup guide a preview? Microsoft announced general availability on October 20, 2026. The linked Learn configuration guide still carries a preview label and an older update date, so use the announcement for current availability and check the portal and current documentation for setup prerequisites.