To achieve your goal, you must create a central security operations tenant, and use Azure Lighthouse to onboard the two customer Microsoft Entra tenants. Then, deploy individual Microsoft Sentinel workspaces in the customer tenants and grant permissions to your management groups using Azure RBAC, assigning the group for managing both tenants to work with both workspaces and the single-tenant group to only the relevant workspace. Reference: https://learn.microsoft.com/en-us/azure/sentinel/prepare-multiple-workspaces