Question

A managed service provider (MSP) needs to administer resources across 40 separate customer Azure tenants. Each customer requires that the MSP's engineers can perform operations (VM management, monitoring, patching) without creating individual accounts in each customer directory, and that access can be centrally revoked. Customers also insist that their own Azure AD user and group objects never appear in the MSP tenant, and that the MSP's own subscription billing remains completely separate. Which identity and access solution should you recommend?

Accepted Answer

Onboard each customer subscription to Azure Lighthouse, delegating scoped RBAC roles to Azure AD groups defined in the MSP's tenant.

Answer

Invite the MSP engineers as B2B guest users into each of the 40 customer tenants and assign them RBAC roles at the subscription scope.

Answer

Create an Azure AD B2B cross-tenant synchronization from each customer tenant into the MSP tenant and assign roles to the synced accounts.

Answer

Establish an Azure AD multi-tenant enterprise application and grant it Contributor across each customer subscription via service principal consent.