Lighthouse and Partner Admin Link

Use Azure Lighthouse for your multi-tenanted managed service delivery and combine with Partner Admin Link.

Introduction

Combining Azure Lighthouse and Partner Admin Link helps Microsoft to recognising the impact that your managed services have within customer subscriptions.

This has more importance with the changes to the partner program this financial year, and the focus on roles that are eligible for recognition.

These pages start with some theory to help you

  • understand the partner program, criteria and partner attached ACR mechanisms

  • dive deeper into PAL and Azure Lighthouse to understand the benefits and nuances

    Short on time? Just read the __In Brief section at the top and then jump to the next page.

    For those who want a little more detail (and links to the official Microsoft docs) then keep scrolling down.

Finally we will walk through some examples:

  • a minimal config
  • an expanded version with a service principal for Terraform deployment
  • a more complex configuration with additional roles elevated via Privileged Identity Management

The examples use the Support Request Contributor role which is eligible for partner earned credit and therefore for PAL recognition in FY23.

Content

Microsoft Cloud Partner Program

A quick overview of the key updates to the partner program for FY23 and the ACR based criteria within the partner score.

Combining Lighthouse and PAL

How combining Partner Admin Link with Azure Lighthouse differs to traditional access.

Minimal Lighthouse definition

An example Lighthouse definition with a minimal set of managed service roles that are also valid for ACR recognition via PAL.

Using service principals

Add a service principal to the authorizations. Learn how to configure Partner Admin Link for service principals.

Privileged Identity Management

An example Lighthouse definition with a mix of permanent and PIM eligible roles. Maintain ACR recognition whilst meeting least privilege requirements. Enable just in time access to elevated permissions with approvals.