AZ-900 Practice Question 99: Lighthouse Cross Tenant Management
Microsoft Azure Fundamentals (AZ-900) · Test 10 · question 9 of 10
A managed service provider (MSP) runs day-to-day operations for 30 client companies, each with its own separate Microsoft Entra tenant and Azure subscriptions. The MSP wants its engineers to sign in once, in the MSP's own tenant, and manage delegated resources in every client's tenant from there, while each client keeps full visibility into what the MSP's engineers do and can revoke access at any time. What should the MSP use?
Show answer and explanation
Answer:
Azure Lighthouse lets a managing tenant "securely manage their customers' Azure resources... from within their own tenant, without having to switch context and control planes." Customers control exactly which scopes and permissions they delegate, can audit every action the provider's engineers take in their own tenant's activity log, and can remove access at any time, matching every requirement in the stem, including the one-sign-in, cross-tenant experience.
Option A runs the delegation backward: B2B guest invitations bring a *client's* administrators into the MSP's tenant as users, rather than delegating the *clients' resources* into a single view the MSP can manage from its own tenant. Option B would require dissolving each client's independent identity boundary into one shared tenant, which no client running its own regulated business would accept, and it is not how multi-customer management is done. Option C cannot work at all: management groups only organize subscriptions that already belong to the same Microsoft Entra tenant, so subscriptions scattered across 30 distinct client tenants can never be gathered under one management group.
Reference: What is Azure Lighthouse?