Azure Lighthouse

What is Azure Lighthouse?

Azure Lighthouse is a Microsoft Azure service that enables centralized and secure management of Azure resources across multiple tenants and subscriptions. It is particularly useful for managed service providers (MSPs) and enterprises with complex Azure environments. Azure Lighthouse provides features like role-based access control (RBAC), cross-tenant and cross-subscription management, monitoring, auditing, and resource delegation, allowing for efficient and secure service delivery while maintaining strict access controls and visibility.

Benefits

The benefits of Azure Lighthouse can be summarized in the following key points:

1. Centralized Management:
   Azure Lighthouse allows centralized management of resources across multiple Azure tenants and subscriptions, streamlining administrative tasks.

2. Secure Resource Access:
   Role-Based Access Control (RBAC) ensures that access to resources is controlled, providing a high level of security.

3. Efficient Service Delivery:
   Managed service providers (MSPs) can efficiently deliver services to multiple customers, enhancing productivity and reducing management overhead.

4. Cross-Tenant Visibility:
   Azure Lighthouse provides a single-pane view across tenants, improving visibility and control over resources.

5. Monitoring and Auditing:
   Azure Lighthouse integrates with Azure Monitor and Azure Security Center, enhancing monitoring and auditing capabilities for better resource management and security.

6. Compliance and Security:
   Azure Lighthouse offers secure and compliant resource management with features like just-in-time access and activity auditing.

Capabilities

Azure Lighthouse provides several key capabilities to facilitate the centralized, secure, and efficient management of resources across multiple Azure tenants and subscriptions. Some of its core capabilities include:

1. Multi-Tenant Management:
   Azure Lighthouse enables the management of Azure resources across different Azure tenants, providing a unified view and control over diverse environments.

2. Role-Based Access Control (RBAC):
   RBAC is a fundamental capability that allows you to assign granular permissions and roles to service providers, ensuring they have the appropriate level of access to resources.

3. Cross-Subscription Resource Management:
   It enables you to manage resources across various Azure subscriptions, making it easier to handle resources spread across different departments or purposes.

4. Secure and Compliant Operations:
   Azure Lighthouse is designed with security and compliance in mind, offering features like just-in-time access and activity auditing to maintain resource security.

5. Monitoring and Visibility:
   It integrates with Azure Monitor and Azure Security Center to provide monitoring and visibility into the health and performance of resources across multiple tenants.

Architecture

Azure Lighthouse is a service provided by Microsoft Azure that enables centralized and secure management of resources across multiple Azure tenants and subscriptions. While it doesn't have a complex architectural setup like some other Azure services, it relies on a few key components to function effectively:

1. Service Provider:
   The service provider is typically a managed service provider (MSP) or an organization that offers services to one or more customers. They use Azure Lighthouse to manage the customer's Azure resources efficiently.

2. Customer Tenants:
   Each customer has its own Azure tenant, which may consist of one or more Azure subscriptions and associated resources. These are managed by the service provider on behalf of the customer.

3. Azure Lighthouse Portal:
   The Azure portal is the primary user interface for managing Azure resources. Service providers and their customers login to the Azure portal to access Azure Lighthouse features.

4. Azure AD (Azure Active Directory):
   Azure AD is used for identity and access management. Service providers and customers authenticate using Azure AD, and RBAC (Role-Based Access Control) is employed to define access permissions for the various stakeholders.

5. Role-Based Access Control (RBAC):
   RBAC is a fundamental part of the architecture. It enables fine-grained control over who can access what resources and perform specific actions within the customer's Azure subscriptions.

How it Works?

It works through the following steps:

1. Establishing the Relationship:

   • The MSP and the customer establish a service provider-customer relationship. This is typically initiated by the MSP.

2. Creating an Azure Lighthouse Assignment:

   • The MSP, with the appropriate permissions, creates an "Azure Lighthouse assignment" within the Azure portal.
   • The assignment specifies the customer's Azure AD tenant ID, the scope of access (e.g., specific subscriptions, resource groups, or all subscriptions), and the permissions or roles granted to the MSP.

3. Role-Based Access Control (RBAC):

   • RBAC is a core component. The permissions specified in the Azure Lighthouse assignment define what actions the MSP can perform within the customer's Azure resources.

4. Customer's View:

   • From the customer's perspective, they can see the MSP's presence in their Azure portal. However, the customer maintains control and visibility over the relationship.

5. Resource Management:

   • With the assignment in place, the MSP can log in to their own Azure portal, navigate to the customer's tenant, and manage resources as specified in the assignment.
   • The MSP can manage resources across subscriptions and resource groups based on the permissions granted.

6. Monitoring and Auditing:

   • Azure Lighthouse integrates with Azure Monitor and Azure Security Center. This provides monitoring, auditing, and security capabilities to ensure that actions and access are tracked and meet security and compliance requirements.

7. Resource Delegation:

   • The MSP may further delegate specific responsibilities to the customer, allowing them to manage certain aspects of their Azure resources. This empowers customers while maintaining overall control.

8. Single Sign-On (SSO):

   • Azure Lighthouse supports single sign-on, simplifying access for the MSP to manage resources across different tenants.

9. Usage and Billing Reporting:

   • Azure Lighthouse helps track resource usage and costs across multiple tenants and subscriptions, simplifying billing and reporting for both the MSP and the customer.

Azure Delegated Resource Management

Azure Delegated Resource Management is a vital element within Azure Lighthouse, enabling the seamless representation of resources from one tenant to another. This capability streamlines the engagement and onboarding process for service providers, offering them increased efficiency and precision when managing delegated resources on a large scale. With Azure Delegated Resource Management, authorized users can operate seamlessly within the context of a customer's subscription, all without the need for direct access to the customer's tenant account or co-ownership of the said tenant.

Cross Tenant Management

Cross-tenant management in Azure Lighthouse refers to the capability of managing Azure resources that belong to different Azure tenants from a single management interface. This is particularly valuable for managed service providers (MSPs) or organizations that need to oversee and administer resources across multiple customers or departments with distinct Azure tenants.

Key aspects of cross-tenant management in Azure Lighthouse include:

1. Centralized Management
2. Role-Based Access Control (RBAC)
3. Resource Delegation
4. Security and Compliance
5. Single Sign-On (SSO)
6. Scalability
7. Billing and Usage Reporting

What is Tenant?

In the context of Azure Lighthouse, a "tenant" refers to a distinct Azure environment or organization that has its own set of resources and subscriptions. Azure Lighthouse allows service providers to manage resources in multiple tenants from a central location while maintaining logical separation and secure isolation between tenants. Each tenant can have its subscriptions, users, and resources, and Azure Lighthouse streamlines management and access control across these tenants.

Azure Lighthouse vs Azure Managed Services

Comparing Azure Lighthouse and Azure Managed Services in a table:

Azure Enhanced Services

The majority of actions and services can be executed across managed tenants through delegated resources. The following outlines some common scenarios where cross-tenant management proves highly advantageous:

Azure Arc:

• All servers in use are Azure Arc enabled.
• Linux machines and Windows servers can be effectively managed.
• Azure resources, such as Azure Policy and tagging, are utilized for computer management.
• It's essential to maintain uniform policies across clients' hybrid environments.

Cost Management & Billing in Azure:

• CSP partners can access, oversee, and analyze pre-tax consumption expenses (excluding purchases) for Azure plan customers through the managing tenant.
• The pricing structure is determined by retail rates and the partner's Azure role-based access control (Azure RBAC) permissions for the customer's subscription.

Azure Backup:

• Currently, the Backup Explorer option is exclusively available for Azure VM data.
• Backup Reports offer historical trend tracking, assessment of backup storage utilization, and auditing of backups and restores within assigned subscriptions.