Beyond Azure Lighthouse: What MSSPs Need for Sentinel at Scale
Reviewed by ContraForce team
Comparison
Azure Lighthouse handles access delegation. ContraForce handles security operations. Together, they give MSSPs the infrastructure and operational layers needed to deliver Sentinel services at scale.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.
- Evidence-linked investigations
- Complements Lighthouse
- SOC 2 Type II
Lighthouse Is Infrastructure.
You Need Operations.
Azure Lighthouse solves an important problem: it lets MSSPs access customer Azure subscriptions and Sentinel workspaces through delegated resource management. That is the infrastructure layer. It handles RBAC, cross-tenant access, and resource visibility.
But Lighthouse does not triage incidents. It does not enforce standard operating procedures (SOPs). It does not automate investigation workflows or route tickets to your PSA. It gives you access to the data, not a system to act on it.
Most MSSPs using Lighthouse still rely on manual processes, custom scripts, and analyst effort to deliver consistent security services across tenants. That is the gap.
Lighthouse gets you in the door. ContraForce runs the operation once you are inside.
Lighthouse vs ContraForce
| Capability | Azure Lighthouse | ContraForce |
|---|---|---|
| Cross-tenant visibility | Delegated resource management in Azure portal | Unified SOC control plane with incident-level visibility |
| Incident automation | None: manual investigation required | Security Delivery Agents automate triage, investigation, and response |
| SOP enforcement | No SOP capabilities | Gamebooks enforce SOPs with human-in-the-loop approvals |
| Per-tenant analytics | Azure Monitor and Sentinel per workspace | Per-tenant delivery metrics, SLA tracking, and reporting |
| Deployment complexity | ARM templates, delegation setup per tenant | Federated access with tenant-specific validation |
| RBAC management | Azure delegated RBAC: manual configuration | Role-based access with tenant-level controls built in |
| AI-driven triage | Not available | Gamebook-governed triage and investigation for eligible workflows |
| Ticketing and PSA integration | Not available | Native integration with Autotask, ServiceNow and Jira; ConnectWise and others via webhooks |
Lighthouse Alone vs.
Lighthouse + ContraForce
Lighthouse Only
- Cross-tenant access requires jumping between Sentinel workspaces
- Every incident requires manual analyst triage and investigation
- SOPs live in documentation, and enforcement is inconsistent
- No centralized delivery metrics or SLA tracking across tenants
- Scaling means adding analysts proportional to tenant growth
Lighthouse + ContraForce
- Unified control plane with cross-tenant incident visibility
- Security Delivery Agents run eligible triage and investigation workflows
- Gamebooks enforce SOPs consistently across every tenant
- Per-tenant delivery metrics and SLA tracking in one dashboard
- Scale tenant count without proportional headcount growth
6
Delivery stages
0
Duplicated customer log stores
1
Multitenant control plane
1
Attributable audit trail
The Operations Layer
Lighthouse Does Not Provide
Automated Incident Execution
Lighthouse gives you access to incidents. ContraForce triages, investigates, enriches, documents, and routes them automatically. Your analysts handle escalations, not every alert.
SOP Enforcement via Gamebooks
Define your SOPs once. Gamebooks enforce them across every tenant, every incident, with human-in-the-loop approvals for high-risk actions. Delivery becomes repeatable.
Per-Tenant Delivery Analytics
Track SLA compliance, incident volume, response times, and analyst throughput per tenant. Lighthouse shows you resources. ContraForce shows you delivery performance.
PSA and Ticketing Integration
ContraForce routes incidents to ConnectWise, Autotask, ServiceNow, and Jira. Lighthouse has no concept of ticketing workflows. Your delivery pipeline stays connected end-to-end.
Frequently asked questions.
Does ContraForce replace Azure Lighthouse?
No. ContraForce complements Lighthouse. Lighthouse handles delegated access to customer Azure resources and Sentinel workspaces. ContraForce provides the operational layer on top: automated incident response, standard operating procedure (SOP) enforcement, and delivery analytics. Most MSSPs use both together.
Do I need Lighthouse if I use ContraForce?
Not necessarily. ContraForce uses its own federated access model to connect to customer Sentinel and Defender XDR environments. Some MSSPs use Lighthouse for broader Azure resource management alongside ContraForce for security operations. They are independent but complementary.
Can ContraForce work with my existing Lighthouse deployment?
Yes. ContraForce integrates with your existing Microsoft environment regardless of whether Lighthouse is deployed. There are no conflicts. ContraForce operates at the security operations layer while Lighthouse operates at the Azure resource management layer.
How does ContraForce handle cross-tenant access differently?
Lighthouse uses Azure delegated resource management with ARM templates. ContraForce uses a federated access model that connects to customer Sentinel and Defender XDR without requiring Azure subscription-level delegation. Validate access, permissions, and an eligible workflow for every connected tenant.
What if I am scaling from ten tenants to hundreds?
This is exactly where ContraForce provides the most value. Lighthouse alone does not run the incident workflow. ContraForce applies Gamebook-governed triage and investigation to eligible incidents, letting you measure analyst throughput and delivery cost as tenant count grows.
Is ContraForce only for Sentinel, or does it work with Defender XDR too?
ContraForce works with both Microsoft Sentinel and Defender XDR. The platform automates incident response across both products, giving your SOC a unified operational view regardless of which Microsoft security products your customers use.
See the Operations Layer
Your Lighthouse Deployment Is Missing
Connect ContraForce to your existing Sentinel environment and validate automated incident execution alongside your Lighthouse deployment.
No credit card. Connect one workspace: scoped Entra ID application consent, no endpoint agents, no log forwarding.