Azure Lighthouse is a service provided by Microsoft Azure that allows service providers to manage multiple customers’ Azure services from a single control plane. It provides a centralized portal to manage multiple Azure tenants, customers or subscriptions, giving the service provider a single view of all Azure resources across different customer environments. Azure Lighthouse provides several features including delegated resource management, multi-tenant management, and cross-tenant management, which help service providers to manage resources across their entire customer base in a secure and efficient manner. It simplifies and streamlines the management of Azure services, provides greater visibility into customers’ environments, and enables service providers to deliver better services to their customers.
In Short, we give access to a subscription or resource to a User/Group in another tenant with specific Roles.
Sample ARM Template for adding a Customer account to Service Providers Lighthouse.
"managedByTenantId": "a86bc255-XXXX-CCCC-VVVV-51fba84872aa"
Above is the Tenant ID of the Managed Services Provider.
"defaultValue": "XXXXXXXXXXXXXXXXXXXXXXX"
Above is the Name of the Offering.
defaultValue": "YYYYYYYYYYYYYYYYYYYYYYYYYY"
Above is the Description of the Offering.
"principalId": "9d45cb5e-4682-4a4d-b54a-a89e3fa7bc84",
Above is the Object ID of the User or the Group we are selecting for this Offering.
"roleDefinitionId": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
Above is the ID of the Role we are selecting.
"principalIdDisplayName": "Azure Reader Access"
Above is the Name of the Role we are selecting.
Sample ARM
{
"$schema": "https://schema.management.azure.com/schemas/2019-08-01/subscriptionDeploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"mspOfferName": {
"type": "string",
"metadata": {
"description": "Specify a unique name for your offer"
},
"defaultValue": "XXXXXXXXXXXXXXXXXXXXXXX"
},
"mspOfferDescription": {
"type": "string",
"metadata": {
"description": "Name of the Managed Service Provider offering"
},
"defaultValue": "YYYYYYYYYYYYYYYYYYYYYYYYYY"
}
},
"variables": {
"mspRegistrationName": "[guid(parameters('mspOfferName'))]",
"mspAssignmentName": "[guid(parameters('mspOfferName'))]",
"managedByTenantId": "a86bc255-XXXX-CCCC-VVVV-51fba84872aa",
"authorizations": [
{
"principalId": "9d45cb5e-AAAA-BBBB-CCCCC-DDDDDDDD",
"roleDefinitionId": "acdd72a7-3385-48ef-bd42-f606fba81ae7",
"principalIdDisplayName": "Azure Reader Access"
},
{
"principalId": "9d45cb5e-AAAA-BBBB-CCCCC-DDDDDDDD",
"roleDefinitionId": "cfd33db0-3dd1-45e3-aa9d-cdbdf3b6f24e",
"principalIdDisplayName": "Support Request Contributor"
}
]
},
"resources": [
{
"type": "Microsoft.ManagedServices/registrationDefinitions",
"apiVersion": "2020-02-01-preview",
"name": "[variables('mspRegistrationName')]",
"properties": {
"registrationDefinitionName": "[parameters('mspOfferName')]",
"description": "[parameters('mspOfferDescription')]",
"managedByTenantId": "[variables('managedByTenantId')]",
"authorizations": "[variables('authorizations')]"
}
},
{
"type": "Microsoft.ManagedServices/registrationAssignments",
"apiVersion": "2020-02-01-preview",
"name": "[variables('mspAssignmentName')]",
"dependsOn": [
"[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
],
"properties": {
"registrationDefinitionId": "[resourceId('Microsoft.ManagedServices/registrationDefinitions/', variables('mspRegistrationName'))]"
}
}
],
"outputs": {
"mspOfferName": {
"type": "string",
"value": "[concat('Managed by', ' ', parameters('mspOfferName'))]"
},
"authorizations": {
"type": "array",
"value": "[variables('authorizations')]"
}
}
}