Question

A managed service provider (MSP) operates its own Azure AD tenant and must manage virtual machines and monitoring resources across 40 customer subscriptions, each in a separate customer Azure AD tenant. The MSP wants its own engineers to sign in with their existing MSP tenant credentials and be granted least-privilege, auditable access to the customer resources without creating guest accounts in each customer tenant. Which solution should you recommend?

Accepted Answer

Onboard the customer subscriptions to Azure Lighthouse and delegate access to MSP tenant security groups with defined built-in roles

Answer

Invite each MSP engineer as a B2B guest user in every customer tenant and assign RBAC roles per subscription

Answer

Create a shared service principal in each customer tenant and store its credentials in the MSP's Azure Key Vault for engineers to use

Answer

Configure Azure AD cross-tenant synchronization to provision MSP user objects into each customer tenant