Playbooks to be used by customers

Welcome to Microsoft Q&A.

@Phumlani Zwane I hope you are doing well,

Yes, this scenario is supported with Azure Lighthouse, but the permissions depend on where the playbook is hosted.

For a multitenant Sentinel deployment, Microsoft documents that an automation rule in one tenant can run a playbook located in another tenant. The Microsoft Sentinel service account must have permission to run the playbook in the tenant where the playbook resides.

For your Meraki scenario, I would check the following:

1. Identify where the playbook/Logic App is hosted.

In the tenant where the playbook resides, go to:

Microsoft Sentinel > Settings > Playbook permissions > Configure permissions

Grant Microsoft Sentinel permission to the resource group containing the playbook. Microsoft documents this specifically for multitenant deployments.

If you are using an MSSP model where the automation rule is created from the service-provider tenant but the playbook runs in the customer tenant, Microsoft requires additional Azure Lighthouse delegation. Specifically, the Azure Security Insights application must be granted the Microsoft Sentinel Automation Contributor role in the appropriate Azure Lighthouse delegation.

The Meraki connector is a separate consideration. The Logic App/playbook uses its configured connector connection and authentication. Azure Lighthouse provides the cross-tenant management permissions; it does not automatically change the Meraki connection to the customer's firewall.

So, if the goal is:

Customer Sentinel → Azure Lighthouse → Playbook → Customer Meraki Firewall

make sure the playbook has the appropriate permissions in the customer tenant and that the Meraki connector is authenticated/configured for that customer's Meraki environment.

Microsoft documentation

Automate and run Microsoft Sentinel playbooks — this is the most relevant reference. It includes the multitenant playbook permission procedure and the MSSP/Azure Lighthouse scenario. Microsoft Learn – Automate and run Microsoft Sentinel playbooks

Manage Microsoft Sentinel workspaces at scale with Azure Lighthouse — explains how Azure Lighthouse supports cross-tenant Microsoft Sentinel management and playbook scenarios. Microsoft Learn – Manage Microsoft Sentinel workspaces at scale

Create and manage Microsoft Sentinel playbooks — covers playbook architecture, Logic Apps, and the required Azure roles. Microsoft Learn – Create and manage Microsoft Sentinel playbooks

If this answer helped clarify the platform capabilities and save you troubleshooting time, please consider marking it as Accepted. This helps others in the community find similar solutions.