{"id":1157,"date":"2019-07-11T00:00:00","date_gmt":"2019-07-11T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/how-azure-lighthouse-enables-management-at-scale-for-service-providers"},"modified":"2025-06-25T00:12:31","modified_gmt":"2025-06-25T07:12:31","slug":"how-azure-lighthouse-enables-management-at-scale-for-service-providers","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/how-azure-lighthouse-enables-management-at-scale-for-service-providers\/","title":{"rendered":"How Azure Lighthouse enables management at scale for service providers"},"content":{"rendered":"\n

Extending Azure Resource Manager with delegated resource management<\/h3>\n\n\n\n

Today, Erin Chapple, Corporate Vice President, Microsoft Azure, announced the general availability of Azure Lighthouse<\/a>, a single control plane for service providers to view and manage Azure across all their customers. Inspired by Azure partners who continue to incorporate infrastructure-as-code and automation into their managed service practices, Azure Lighthouse introduces a new delegated resource concept that simplifies cross-tenant governance and operations.<\/p>\n\n\n\n

Granular access, better automation, and simplified customer onboarding<\/h2>\n\n\n\n

Powering Azure Lighthouse is an Azure Resource Manager capability called delegated resource management<\/a>. Delegated resource management lets customers delegate permissions to service providers over scopes, including subscriptions, resource groups, and individual resources, which enable service providers to perform management operations on their behalf. After customers delegate resources to a service provider, the provider can provide access to users or accounts in provider\u2019s tenant within the constraints specified by the customer, using the standard role-based access control (RBAC) mechanisms. The standard RBAC mechanisms work as if customer resources were resources in provider\u2019s own subscriptions. Finally, delegated resource management works consistently regardless of the licensing construct service providers and their customers might choose\u2014enterprise agreement (EA), cloud solution provider (CSP), and pay-as-you-go.<\/p>\n\n\n\n

\u201cAzure delegated resource management enables Nordcloud customers to easily provide secure access. It simplifies onboarding new managed services customers, ensuring our high security and compliance standards are met.\u201d <\/em><\/p>\n\n\n\n

Ilja Summala, Group CTO, Nordcloud<\/strong><\/p>\n\n\n\n

Cross-tenant management at scale, with enhanced visibility and governance<\/h2>\n\n\n\n

Delegated management uniquely supports management-at-scale and automation patterns of service providers, whether those providers are managed services partners acting on behalf of customers or central IT teams of enterprises with multiple Azure tenants. Partners can now manage tens of thousands of resources from thousands of distinct customers from their own Azure portal or CLI context. Because customer resources are visible to service providers as Azure resources in their own tenant, service providers can easily automate status monitoring, and applying create, update, change, delete (CRUD) changes across the resources of many customers from a single location.<\/p>\n\n\n\n

Everything relevant to Azure resource management, from the Azure portal to services such as Azure Policy, Resource Graph, Log Analytics feature of Azure Monitor, or Update Management, all honor delegated resource management. What\u2019s more, both customers and service providers can see who took actions on the resources from the activity log, increasing accountability for both parties, with protection of the privacy of individual service provider identities. That\u2019s because the newly built resource provider, Microsoft Managed Services, enables Azure services to determine if a call was made from a resource\u2019s home tenant or from a service provider\u2019s tenant.<\/p>\n\n\n\n

\"Delegated<\/figure>\n\n\n\n

Our partners have several options for how they use these new capabilities. Since the Azure Lighthouse portal experiences have corresponding APIs, PowerShell, Azure CLI, REST APIs, or client SDKs<\/a>, it\u2019s easy to integrate into other cloud management portals, ITSM tools, or monitoring tools.<\/p>\n\n\n\n

How our partners use Azure Lighthouse<\/h2>\n\n\n\n

Examples from two of our expert partners, Rackspace and Sentia, highlight the power of Azure Lighthouse and delegated resource management:<\/p>\n\n\n\n

Rackspace<\/strong> is enhancing security and response capabilities using Azure Lighthouse in three steps:<\/p>\n\n\n\n

    \n
  1. Utilizing Azure Resource Graph and cross-tenant queries to quickly detect which customers have impacted images or hosts deployed<\/li>\n\n\n\n
  2. Applying an in-guest audit policy across all customers\u2019 managed estates to verify host settings relating to impact\/vulnerability<\/li>\n\n\n\n
  3. Using update management to report on impacted systems and schedule targeted hot fixes<\/li>\n<\/ol>\n\n\n\n

    Sentia<\/strong> pivoted CI\/CD pipeline to use declarative Azure Resource Manager templates for provisioning management artifacts across all customers who are under Azure CSP licensing construct. Sentia\u2019s managed services offer is now 90 percent based on Resource Manager templates<\/a>, which simplifies deployments dramatically, automating monitoring, governance, and management tasks at scale, across customers. <\/p>\n\n\n\n

    Continued Azure Resource Manager investments for our partners<\/h2>\n\n\n\n

    Azure Lighthouse and delegated resource management are just the latest of the platform investments we continue to make for our partners. Together with Azure managed applications and custom providers, they enable comprehensive management-at-scale capability for partners and customers. To hear more, watch my demo at Microsoft Build 2019<\/a>. Some of the other management innovations we\u2019ve made include the following:<\/p>\n\n\n\n