You are a security engineer at a managed security service provider (MSSP) that is onboarding to Google Security Operations (SecOps). You need to…

Google Security Operations SOAR is designed for multi-tenancy, a critical requirement for Managed Security Service Providers (MSSPs). The platform achieves logical separation for different customers through the use of "Environments." Each environment acts as a distinct, self-contained workspace with its own cases, dashboards, playbooks, integrations, and user permissions. Creating a new environment for each customer ensures that all data and operations for one customer are completely isolated from all others, preventing data leakage and allowing for customized configurations per client.

A. Roles define user permissions (e.g., what actions a user can perform) but do not create the fundamental logical separation of customer data and workspaces.

B. Playbooks are automated workflows that operate on cases. While they can be customized per customer, they exist within an environment and do not provide the data segregation itself.

C. Permissions groups are used to manage user access by bundling users and assigning roles. They control access to data but do not create the isolated data containers.

1. Google Cloud Documentation

"Multi-tenancy overview": "Google Security Operations SOAR provides multi-tenancy support by using environments. An environment is a standalone unit that contains all the components of a single Google Security Operations SOAR deployment... For example

an MSSP can create a separate environment for each of its customers." This document explicitly states that environments are the designated feature for MSSP customer separation.

2. Google Cloud Documentation

"Manage environments": "As an MSSP

you can create and manage multiple environments to support your customers. Each environment is a standalone unit with its own set of cases

playbooks

integrations

and so on." This further reinforces that environments are the correct mechanism for creating standalone units per customer.

3. Google Cloud Documentation

"Roles and permissions": This page details the function of roles (e.g.

Administrator

Tier1Analyst) and permissions

clarifying that their purpose is to control user actions and access levels within the platform

not to partition the platform's data into separate customer tenants.