azure-lighthouse

Azure Lighthouse enables cross-tenant delegated resource management for MSPs without guest accounts. It uses ARM projections to establish a single control plane, allowing you to manage multiple customer tenants without requiring per-subscription logins or individual guest user provisioning.

You can deploy cross-tenant delegation templates by applying ARM templates or Bicep files directly in the customer tenant. This onboarding process grants the Managed Service Provider specific RBAC boundaries and delegated access to manage the designated Azure resources.

Yes, Azure Lighthouse supports just-in-time (JIT) access through Privileged Identity Management (PIM). This allows MSPs to request temporary, elevated RBAC activations for specific cross-tenant management tasks, ensuring governance and minimizing standing access to customer resources.

The best way to enforce RBAC boundaries is through Azure Lighthouse delegated access. It provides sample definitions and assignments that restrict MSP permissions strictly to the roles defined during the ARM template onboarding, ensuring ongoing operational governance across customer tenants.

Yes, Azure Lighthouse supports the use of Bicep and Azure CLI commands to manage definitions and assignments. This allows you to automate the deployment of cross-tenant governance configurations and enforce delegated access boundaries programmatically across customer environments.

You need cross-tenant delegated access when managing resources across multiple Azure tenants as an MSP or enterprise IT team. It eliminates the need to switch directories or use per-subscription logins, providing a single control plane for ongoing operations and governance.