What is Azure Lighthouse?
Azure Lighthouse is a management service that enables service providers and enterprise teams to manage Azure resources across multiple tenants from their own Microsoft Entra tenant, without switching between tenant logins. The service provides secure, scalable delegated access management with full transparency and control for customers.
Unlike traditional multi-tenant approaches with separate accounts per customer, providers work directly from their own tenant. Customers explicitly delegate access rights via Azure Resource Manager templates or managed service offers, but retain full control and can revoke permissions at any time.
Core Features
- Delegated resource management across tenant boundaries
- Granular RBAC-based permissions for delegated resources
- Central view of all managed customer resources in the provider portal (My Customers)
- Full transparency for customers over all delegated access via the Azure Activity Log
- Just-In-Time (JIT) access for temporary, elevated permissions
Typical Use Cases
Managed Service Provider: MSPs manage Azure environments of multiple customers from a central console without switching between tenant logins.
Enterprise with Subsidiaries: Large companies with separate tenants for subsidiaries manage IT services centrally.
Compliance and Auditing: External auditors receive temporary, delegated read access to resources without creating separate accounts.
Benefits
- No additional cost for Azure Lighthouse itself
- Scalable management without credential sharing between tenants
- Customers retain full control and transparency over delegated access
- Automation via Azure Resource Manager, Azure CLI, and PowerShell
Frequently Asked Questions
What is Azure Lighthouse?
Azure Lighthouse is a free management service that lets service providers and enterprises centrally manage Azure resources across multiple tenants from their own tenant, without limiting customers’ control over their resources.
How are permissions delegated?
Customers deploy Azure Resource Manager templates or use Managed Service Offers in the Azure Marketplace. These define which resources and roles are delegated to the provider.
What does Azure Lighthouse cost?
Azure Lighthouse itself is free. Resources managed through Lighthouse continue to be billed normally in the customer’s own tenant.
Can customers monitor access?
Yes, all activities are logged in the customer’s Azure Activity Log. Customers can see who accesses their resources at any time.
Is Azure Lighthouse secure?
Azure Lighthouse uses Microsoft Entra ID (formerly Azure Active Directory) and RBAC. No credentials are shared, and customers can revoke delegations at any time.
Which resources can be delegated?
Nearly all Azure resources can be delegated. Exceptions are certain Microsoft Entra ID and billing-related operations.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory uses Azure Lighthouse for efficient management of customer Azure environments. We help with setup and best practices for multi-tenant management.
Contact us for a non-binding consultation on Azure Lighthouse.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
