Azure Lighthouse

Azure Lighthouse is for both managed service providers (MSPs) and customers. MSPs can use Azure Lighthouse to help build and scale a secure managed services practice, while customers benefit from best practice security features. Enterprise customers also deploy Azure Lighthouse internally to help manage multiple internal tenants, often after a merger or acquisition.

By using Azure delegated resource management, MSPs no longer need to create administrator accounts in your company’s tenants. This allows MSPs to manage the life cycle of delegated administrators within their own Azure AD tenant. MSPs can also add user accounts to the user group in their Azure AD tenant while, as a customer, you make sure those groups have the required access to manage their resources. To revoke access, the user is removed from the specific group access that was delegated.

Azure Lighthouse capabilities apply consistently across all licensing and sales channels. You can continue to work with CSPs and use valuable new management tools. For example, the cross- and multi-customer managed service provider access framework enables granular access control and scope definition for CSPs—key to both customers and partners.

Azure is the only cloud provider that offers consistent, centralized management and monitoring capabilities for partners to manage on behalf of customers through a single control plane and at scale. We’re the only provider enabling partners to grow their business through multiple avenues for delivering management automation. And unlike other cloud providers, Azure allows ISVs and MSPs to incorporate Azure Lighthouse into joint services and solution packages.

Azure delegated resource management is the foundational management technology that powers Azure Lighthouse. This core technology enables customers to delegate and explicitly provision access for single or multiple service providers for defined resource scopes (including subscriptions and resource groups) for specific roles. It enables flexible customer onboarding via Azure Resource Manager templates and Azure Marketplace managed services offerings, simplified governance with Azure Policy and Azure Resource Graph, and cross-tenant management with access to services like Azure Security Center and Azure Service Health.

The EMS E5 or Azure AD Premium P2 license is required on the managing tenant only. This applies to all users who are activating a role in the managing tenant. There are no license requirements for customers.