What is Azure Lighthouse?
Azure Lighthouse is a management service that enables service providers and enterprise teams to manage Azure resources across multiple tenants without switching between tenants. The service provides secure, scalable delegated access management with full transparency and control for customers.
Unlike traditional multi-tenant approaches with separate accounts per customer, providers work directly from their own tenant. Customers explicitly delegate access rights but retain full control and can revoke permissions at any time.
Core Features
- Delegated resource management across tenant boundaries
- Granular RBAC-based permissions for delegated resources
- Central view of all managed customer resources in the provider portal
- Full transparency for customers over all delegated access
- Just-In-Time (JIT) access for enhanced security
Typical Use Cases
Managed Service Provider: MSPs manage Azure environments of multiple customers from a central console without switching between tenant logins.
Enterprise with Subsidiaries: Large companies with separate tenants for subsidiaries manage IT services centrally.
Compliance and Auditing: External auditors receive temporary read access to resources without creating separate accounts.
Benefits
- No cost for Azure Lighthouse itself
- Scalable management without credential sharing
- Customers retain full control and transparency
- Automation via Azure Resource Manager, CLI, and PowerShell
Frequently Asked Questions
How are permissions delegated?
Customers deploy Azure Resource Manager templates or use Managed Service Offers in the Azure Marketplace. These define which resources and roles are delegated to the provider.
Can customers monitor access?
Yes, all activities are logged in the customer’s Azure Activity Log. Customers can see who accesses their resources at any time.
Is Azure Lighthouse secure?
Azure Lighthouse uses Azure AD and RBAC. No credentials are shared. Customers can revoke delegations at any time.
Which resources can be delegated?
Nearly all Azure resources can be delegated. Exceptions are certain Azure AD and billing-related operations.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory uses Azure Lighthouse for efficient management of customer Azure environments. We help with setup and best practices for multi-tenant management.
Contact us for a non-binding consultation on Azure Lighthouse.
