azure-lighthouse

Azure Lighthouse enables secure cross-tenant management by allowing delegated access through role-based access control. It projects customer subscriptions into the managing tenant, streamlining governance without switching directories.

You can onboard subscriptions to Azure Lighthouse using policy-based deployment by assigning ARM templates that enforce delegation at scale. This method ensures ongoing governance and automatically remediates non-compliant resources using managed identities.

Yes, Azure Lighthouse integrates with Privileged Identity Management (PIM) to provide just-in-time access for delegated resources. This allows managing tenants to activate elevated roles temporarily, enhancing security hardening across multi-tenant environments.

Azure Arc integrates with Lighthouse to manage hybrid and multi-cloud resources across tenants. Managing tenants can monitor and govern Arc-enabled servers from a centralized workspace using delegated security and governance patterns.

RBAC in Lighthouse provides granular, role-based delegated access to specific user groups, while Admin on Behalf Of (AOBO) grants broad account-level access to the managing partner. RBAC is recommended for secure, least-privilege multi-tenant governance.

You package and publish Lighthouse managed service offers through Azure Marketplace. This deployment consideration allows ISVs to define authorization mappings and onboard multiple customers to cross-tenant delegations programmatically.