Sentinel October update brings cross-tenant delegated access to GA
**Cross-tenant delegated access and the ASIM EmailEvent schema are generally available in Microsoft Sentinel’s October update.
** MSSPs and central security teams can use home-tenant accounts and Defender unified RBAC, with each governed tenant approving its roles and resource scopes. EmailEvent provides consistent fields for email events across supported sources.
Two other capabilities remain in public preview: SAP BTP vulnerability analytics correlate high- or critical-severity findings with observed application use, while Unified Data Management brings connectors, tables and ingestion health together in the Defender portal.
The latter includes schema, retention and estimated ingestion-cost information to support investigation of data-flow problems.
Partner briefing
- What it is
Microsoft published Sentinel’s October product update.
- What’s changing
Delegated access and EmailEvent are GA; SAP vulnerability analytics and Unified Data Management remain public previews.
- Why it matters
Tenant-approved scopes support least-privilege operations; normalized email data supports consistent detections.
- Who it affects
MSSPs, security operations teams and administrators managing Sentinel data.