unable to change MDR notifications with partner assistance enabled

Question

We found out that you're unable to change MDR Authorized Contacts (as Super Admin) when you have Partner Assistance enabled in Account Support Settings. 
 
 Banner appears: These settings are currently managed by your partner.

This looks like a bug.

Rutvik Chavda · Accepted Answer

Hello LHerzog, 
 Thank you for your thoughtful question regarding the security benefits of Partner Assistance in Sophos Central, particularly around managing MDR (Managed Detection and Response) Authorised Contacts. 
 We hope the following information provides clarity. 
 About Partner Assistance and Administrative Controls: 
 When Partner Assistance is enabled in Sophos Central, your Sophos partner is delegated the management of certain sensitive security and support settings, including MDR Authorised Contacts. 
 Tenant administrators (including those with Super Admin rights) will find these fields restricted and read-only. 
 Your partner must make all changes using the Sophos Central Partner Dashboard. 
 This is indicated in the user interface with a banner such as: 
 &ldquo;Your partner currently manages these settings.&rdquo; 
 On Super Admins Toggling Partner Assistance: In some environments, a tenant-level Super Admin may have the option to disable Partner Assistance and regain direct control of previously restricted settings. This ability depends on: 
 Your licensing model: (for example, whether your account uses Term licensing or is provisioned under MSP Flex.) The controls and configurations set by your Sophos partner or MSP: Some managed service providers enforce additional restrictions; tenants can't typically disable Partner Assistance in many MSP Flex scenarios and must operate under partner management. 
 Security and Operational Benefits Centralised and Audited Control: 
 With Partner Assistance enabled, the partner is solely responsible for critical MDR settings. 
 Centralisation ensures clear accountability, audit trails, and a streamlined response process. 
 Separation of Duties: 
 Strict administrative boundaries are enforced in fully managed MSP environments (where Partner Assistance can't be disabled). 
 This significantly reduces the risks of unauthorised access or accidental changes. 
 If Tenants Retain the Toggle: 
 When Super Admins can disable Partner Assistance, the benefits shift toward operational workflow: centralised processes, transparent roles, and improved auditability. 
 While this scenario is less of a "hard technical restriction," it still supports best practices in delegated responsibility and accountability. 
 We strongly recommend contacting our Customer Care or Partner Care team if you have a specific scenario or need environment-specific advice. They can review your account details and provide precise guidance based on your licensing, partner relationship, and organisational requirements. 
 Please let us know if you need any further assistance.

Rutvik Chavda · Answer

Hello, LHerzog, 
 We appreciate your reaching out to the Sophos Community Forum. 
 Please refer to this information if that helps you. 
 When Partner Assistance is enabled in Sophos Central Account Support Settings, tenant-level Super Admins are expected to be unable to change MDR (Managed Detection and Response) Authorised Contacts. Instead, your Sophos partner exclusively manages these settings and other key administrative controls. Your partner currently manages these settings and communicates this in the product UI. 
 Enabling Partner Assistance delegates the authority for certain configuration and support settings, including MDR Authorised Contacts, from the tenant to the managing Sophos partner. 
 Even with the Super Admin role, tenant administrators are restricted from modifying these fields. This ensures clear separation between partner-managed and tenant-managed environments. 
 Only partner administrators, via the Sophos Central Partner Dashboard, have the necessary permissions to adjust MDR Authorised Contacts when this setting is active. 
 Please contact your Sophos partner if you require changes to your MDR Authorised Contacts while Partner Assistance is enabled. If Partner Assistance is disabled and these controls remain unavailable, I recommend opening a support case for further troubleshooting. Also, please share the case ID here to monitor. 
 This control structure is designed to maintain a robust administrative boundary in managed environments. 
 Let me know if you need any further help.

unable to change MDR notifications with partner assistance enabled

Top Replies