The MSSP SOC I work for currently only adds entities to the Defender indicator lists as a reactive action based on alerts. These indicators are only blocked for the client where the alert triggered. I'm wanting to change this, but I'm not sure how.

The ideal work flow would be that all indicators added to any clients Defender would be automatically collected, validated, then have the ability push these to all clients.

Alternatively, the analysts would add the indicators to a separate tool, which then pushes the blocks out to all clients, whilst still allowing for the ability to do client specific blocks.

Is this something other MSSPs do? Are there any mechanisms to do this?