|
| 1 | +--- |
| 2 | +title: Manage cases across multiple tenants in the Microsoft Defender portal |
| 3 | +description: Learn about case management features for unified security operations across multiple tenants in the Microsoft Defender portal. |
| 4 | +search.appverid: met150 |
| 5 | +ms.service: unified-secops-platform |
| 6 | +ms.author: yelevin |
| 7 | +author: yelevin |
| 8 | +ms.localizationpriority: medium |
| 9 | +ms.date: 05/07/2025 |
| 10 | +audience: ITPro |
| 11 | +ms.collection: |
| 12 | +- M365-security-compliance |
| 13 | +- tier1 |
| 14 | +- usx-security |
| 15 | +ms.topic: conceptual |
| 16 | + |
| 17 | +# customer intent: As a business decision maker for a security operations center, I want to learn about the multi-tenant case management tools available in the Microsoft Defender portal so I can unify security tickets and increase visibility across multi-tenant environments, both hybrid and multicloud; and disrupt attacks on identities, endpoints, email, cloud apps, and data in real time. |
| 18 | +--- |
| 19 | + |
| 20 | +# Manage multi-tenant security operations cases in the Microsoft Defender portal |
| 21 | + |
| 22 | +Case management is the first installment of new capabilities for managing security work when you onboard to Microsoft's unified security operations (SecOps) platform. |
| 23 | + |
| 24 | +This initial step toward delivering a unified, security-focused case management experience centralizes rich collaboration, customization, evidence collection, and reporting across SecOps workloads. SecOps teams maintain security context, work more efficiently, and respond faster to attacks when they manage case work without leaving the Defender portal. |
| 25 | + |
| 26 | +<a name="what-is-case-management-preview"></a> |
| 27 | + |
| 28 | +## What is case management? |
| 29 | + |
| 30 | +Case management enables you to manage SecOps cases natively in the Defender portal. Here's the currently supported set of scenarios and features. |
| 31 | + |
| 32 | +- Define your own case workflow with custom status values |
| 33 | +- Assign tasks to collaborators and configure due dates |
| 34 | +- Handle escalations and complex cases by linking multiple incidents to a case |
| 35 | +- Manage access to your cases using RBAC |
| 36 | +- Manage cases spanning multiple tenants using multitenant management (Preview) |
| 37 | + |
| 38 | +As we build on this foundation of case management, we're prioritizing these additional robust capabilities as we evolve this solution: |
| 39 | + |
| 40 | +- Multi-tenant support *(now added, in Preview)* |
| 41 | +- Automation |
| 42 | +- More evidence to add |
| 43 | +- Workflow customization |
| 44 | +- More Defender portal integrations |
| 45 | + |
| 46 | +## Requirements |
| 47 | + |
| 48 | +Case management is available in the Defender portal, and to use it, you must have a Microsoft Sentinel workspace connected. Cases are accessible only from the Defender portal; you can't see them in the Azure portal. |
| 49 | + |
| 50 | +For more information, see [Connect Microsoft Sentinel to the Defender portal](microsoft-sentinel-onboard.md). |
| 51 | + |
| 52 | +Use Defender XDR unified RBAC or Microsoft Sentinel roles to grant access to case management features. |
| 53 | + |
| 54 | +| Cases feature | Microsoft Defender XDR Unified RBAC | Microsoft Sentinel role | |
| 55 | +|---|---|---| |
| 56 | +| View only</br>- case queue</br>- case details</br>- tasks</br>- comments</br>- case audits | Security operations > Security data basics (read)| Microsoft Sentinel Reader | |
| 57 | +| Create and Manage</br>- cases and case tasks</br>- assign</br>- update status</br>- link and unlink incidents | Security operations > Alerts (manage) | Microsoft Sentinel Responder | |
| 58 | +| Customize case status options | Authorization and setting > Core Security settings (manage)| Microsoft Sentinel Contributor | |
| 59 | + |
| 60 | +For more information, see [Microsoft Defender XDR Unified role-based access control (RBAC)](/defender-xdr/manage-rbac). |
| 61 | + |
| 62 | +## Case queue |
| 63 | + |
| 64 | +To start using case management, select **Cases** in the Defender portal to access the case queue. Filter, sort, or search your cases to find what you need to focus on. |
| 65 | + |
| 66 | +:::image type="content" source="media/cases-overview/cases-queue-view.png" alt-text="Screenshot of case queue."::: |
| 67 | + |
| 68 | +The maximum allowed per tenant is 100,000 cases. |
| 69 | + |
| 70 | +## Case details |
| 71 | + |
| 72 | +Each case has a page which allows analysts to manage the case and displays important details. |
| 73 | + |
| 74 | +In the following example, a threat hunter is investigating a hypothetical "Burrowing" attack that consists of multiple MITRE ATT&CK techniques and IoCs. |
| 75 | + |
| 76 | +:::image type="content" source="media/cases-overview/case-details.png" alt-text="Screenshot of case details." lightbox="media/cases-overview/case-details-large.png"::: |
| 77 | + |
| 78 | +Manage the following case details to describe, prioritize, assign, and track work: |
| 79 | + |
| 80 | +| Displayed case feature | Manage case options | Default value | |
| 81 | +|:---|:---|:---| |
| 82 | +| Priority| `Very low`, `Low`, `Medium`, `High`, `Critical` | none | |
| 83 | +| Status | Set by analysts, customizable by admins | Default statuses are `New`, `Open`, and `Closed`</br>Default value is `New`| |
| 84 | +| Assigned to | A single user in the tenant | none | |
| 85 | +| Description | Plain text | none | |
| 86 | +| Case details | Case ID | Case IDs start at 1000 and aren't purged. Use custom statuses and filters to archive cases. Case numbers are automatically set.| |
| 87 | +| | Created by</br>Created on</br>Last updated by</br>Last updated on | automatically set | |
| 88 | +| | Due on</br>Linked incidents | none | |
| 89 | + |
| 90 | +Manage cases further by setting customized status, assigning tasks, linking incidents, and adding comments. |
| 91 | + |
| 92 | +### Customize status |
| 93 | + |
| 94 | +Architect case management to fit the needs of your security operations center (SOC). Customize the status options available to your SecOps teams to fit the processes you have in place. |
| 95 | + |
| 96 | +Following the burrowing attack case creation example, the SOC admins configured statuses enabling threat hunters to keep a backlog of threats for triage on a weekly basis. Custom statuses such as *Research phase* and *Generating hypothesis* match this threat hunting team's established process. |
| 97 | + |
| 98 | +:::image type="content" source="media/cases-overview/customize-status.png" alt-text="Screenshot showing default status options and customized statuses."::: |
| 99 | + |
| 100 | +### Tasks |
| 101 | + |
| 102 | +Add tasks to manage granular components of your cases. Each task comes with its own name, status, priority, owner, and due date. With this information, you always know who is accountable to complete which task and by what time. The task description summarizes the work to do and some space for describing the progress. Closing notes provide more context about the outcome of completed tasks. |
| 103 | + |
| 104 | +:::image type="content" source="media/cases-overview/add-task-small.png" alt-text="Screenshot showing the task pane with tasks populated for the case and statuses available." lightbox="media/cases-overview/add-task.png"::: |
| 105 | +</br>*Image shows the following task statuses available: New, In progress, Failed, Partially completed, Skipped, Completed* |
| 106 | + |
| 107 | +### Link incidents |
| 108 | + |
| 109 | +Linking a case and an incident helps your SecOps teams collaborate in the method that works best for them. For example, a threat hunter who finds malicious activity creates an incident for the incident response (IR) team. That threat hunter links the incident to a case so it's clear they're related. Now the IR team understands the context of the hunt that found the activity. |
| 110 | + |
| 111 | +:::image type="content" source="media/cases-overview/link-incidents.png" alt-text="Screenshot showing linked incidents for the hypothetical burrowing attack case." lightbox="media/cases-overview/link-incident-chooser.png"::: |
| 112 | + |
| 113 | +Alternatively, if the IR team needs to escalate one or more incidents to the hunting team, they can create a case and link the incidents from the **Investigation & response** incident details page. |
| 114 | + |
| 115 | +:::image type="content" source="media/cases-overview/link-incident-from-incident-graph.png" alt-text="Screenshot showing the link incident option from ellipses menu in the incident view."::: |
| 116 | + |
| 117 | +Each case has a threshold of 100 linked incidents. |
| 118 | + |
| 119 | +### Activity log |
| 120 | + |
| 121 | +Need to write down notes, or that key detection logic to pass along? Create plain text comments and review the audit events in the activity log. Comments are a great place to quickly add information to a case. |
| 122 | + |
| 123 | +:::image type="content" source="media/cases-overview/informal-comments.png" alt-text="Screenshot showing informal comments between analysts."::: |
| 124 | + |
| 125 | +Audit events are automatically added to the activity log of the case and the latest events are shown at the top. Change the filter if you need to focus on comments or audit history. |
| 126 | + |
| 127 | +## Related content |
| 128 | + |
| 129 | +- [Microsoft Sentinel blog - Improve SecOps collaboration with case management](https://techcommunity.microsoft.com/blog/MicrosoftSentinelBlog/improve-secops-collaboration-with-case-management/4369044) |
| 130 | +- [Microsoft Defender Experts for Hunting](/defender-xdr/defender-experts-for-hunting) |
| 131 | +- [Microsoft Sentinel in the Defender portal](/azure/sentinel/microsoft-sentinel-defender-portal) |
0 commit comments