Azure Lighthouse: why an MSP's org is not the same as a tenant

Azure Lighthouse is Microsoft's documented pattern for letting a managed service provider work across many customers' Azure resources from inside its own tenant, without merging any customer's directory into the MSP's. Microsoft calls this Azure delegated resource management: a customer delegates specific subscriptions or resource groups to specified users and roles in the MSP's tenant, and can revoke that access independently at any time.

How the delegation actually works

Under the hood, onboarding a customer creates two resources inside the customer's own tenant: a registration definition, describing what access is being granted and to whom, and a registration assignment, which activates it. When someone in the MSP's tenant tries to act on a delegated resource, Azure Resource Manager authenticates that request the same way it authenticates a request from a user native to the customer's tenant — the MSP user never needs an account inside the customer's directory, and never becomes a co-owner of it. Customers keep visibility into what's been delegated and can see it from their own portal.

Why the terminology gets confused

Microsoft's own guidance is explicit that "organization" and "tenant" are not interchangeable: a single commercial organization — one brand, one legal entity — can span many Microsoft Entra tenants, one per customer, per environment or per acquisition. Lighthouse is built around that reality rather than against it: it lets one organization operate across tenants while keeping each tenant a hard boundary for identity and access. Collapsing that distinction — treating "our org" as if it were one tenant — is the mistake Lighthouse's architecture is designed to prevent, not just document.

For MSPs building or buying multi-tenant tooling of any kind, Azure Lighthouse is a useful reference point: delegated, revocable access into a separate tenant is a different, and generally safer, design than pooling several customers under one shared directory and sorting them out with application-level flags. The distinction is architectural, not a compliance label — worth checking in any vendor's actual access model, not just its marketing copy.

Sources: Microsoft Learn — What is Azure Lighthouse?, Microsoft Learn — Tenants, users, and roles in Azure Lighthouse.