AZ-305 Practice Question 42: Multitenant Managed Service
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 5 · question 2 of 10
A managed service provider operates the Azure estates of 60 customers, each in its own Microsoft Entra tenant. Its 45 engineers currently sign in to each customer's directory separately. The new design must:
- let engineers work on customer resources from within the provider's own tenant, without switching directories, - avoid creating an account for each engineer in each customer tenant, - give each customer precise control over which subscriptions or resource groups are exposed and which roles the provider's engineers hold, - let a customer see what the provider's engineers did and revoke the access at any time.
What should you recommend?
Show answer and explanation
Answer:
Azure delegated resource management, the core of Azure Lighthouse, lets a provider manage customers' Azure resources securely from within its own tenant, without switching context and control planes. Customers delegate specific subscriptions or resource groups to named users and roles in the managing tenant, they can see what the provider's engineers did in their own activity log, and they can remove the access completely at any time. That maps to all four requirements, and Lighthouse adds no extra cost.
Option A is what the provider is trying to stop doing. Guest accounts multiply (45 engineers across 60 tenants is 2,700 identities to create, review, and remove), and engineers still have to sign in to each customer's directory one at a time.
Option B trades a managed delegation for a shared secret. A long-lived credential handed to another organization is exactly the anti-pattern the platform's delegation model exists to remove: there is no per-engineer attribution in the customer's logs, and Contributor across the subscription is far more than a scoped delegation.
Option D changes ownership rather than access. Moving subscriptions into the provider's tenant makes the provider the identity authority for the customers' resources, breaks each customer's own governance and identity integration, and removes the very control the requirements ask to preserve.
Reference: What is Azure Lighthouse?