Beyond Azure Lighthouse: What MSSPs Need for Sentinel at Scale
Reviewed by ContraForce Security Operations Team ยท Updated 2026-08-12
Azure Lighthouse provides cross-tenant access delegation for MSSPs managing Microsoft environments. However, Lighthouse does not automate security operations. MSSPs still manually triage, investigate, and respond to incidents in each tenant.
ContraForce adds the operations layer on top of Lighthouse: Agentic Security Delivery Agents automate incident workflows, Gamebooks enforce SOPs, and a single control plane manages all tenants. ContraForce delivers a 140-second mean time to response and roughly 85% ticket reduction compared to Lighthouse-only operations. Most MSSPs use Lighthouse for access and ContraForce for operations.
Azure Lighthouse vs ContraForce: Feature Comparison
| Capability | Azure Lighthouse | ContraForce |
|---|---|---|
| Cross-tenant access | Yes (delegated access) | Yes (federated access) |
| Incident triage automation | No | Yes (Agentic Security Delivery Agents) |
| Investigation automation | No | Yes (contextual AI investigation) |
| SOP enforcement | No | Yes (Gamebooks) |
| Response execution | No | Yes (governed automation) |
| Per-tenant analytics | Limited | Yes (built-in reporting) |
| Cost per incident | Manual labor ($15-25+) | Security Delivery Agent automation, pay as you go |
| Deployment time | Hours per tenant | about 10 minutes per tenant |
Why MSSPs Need Both
Lighthouse handles infrastructure-level access delegation. ContraForce handles operations-level automation. Together, they give MSSPs the complete stack: Lighthouse for seeing across tenants, ContraForce for acting across tenants with Security Delivery Agents that automate triage, investigation, and response.
Key Metrics
- a 140-second mean time to response compared to Lighthouse-only operations
- roughly 85% ticket reduction
- about 10 minutes to first agent work per tenant
- SOC 2 Type II certified platform