Lighthouse

Hello All,

I gave Contributor role (on a subscription) to users via Lighthouse to manage a customer. The users get access with no problem to the customer subscription, can start and stop VM, create a resource group, start and stop backup, etc.

The problem arises when I want to create for instance a storage account (or a new VM). The portal goes to marketplace and then I am not able to add anything else as if I couldn't contact the subscriptions.

Can you please advise.

Thank you in advance for your reply

giuseppe

Stanislav Zhelyazkov 23,421 Reputation points MVP

2024-06-20T06:25:06.62+00:00

Hi,

Can you provide screenshots of the steps you are doing?

Also can you provide screenshots of the access you are seeing available with that user?

If contributor access was given via Lighthouse creating Storage account or VM is not a problem with such access.
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-06-20T08:08:54.5666667+00:00

Hello Stanislav,

I log in with the Contributor (on the customer subscription) user --> I go to Lighthouse --> My customers -->

I click on one of the customer, for instance the second one and I am on their environment.

Then I go to resources --> and I click create

and when I click on create a VM

I end up here, as if I couldn't get to the customer subscriptions.

beppe
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-06-20T08:26:37.79+00:00

Ah,

My own tenant does not have a subscription, it is only an AAD tenant: I do not think that is a limitation hence I have to create things on a customer subscription.

beppe
Stanislav Zhelyazkov 23,421 Reputation points MVP

2024-06-20T08:39:35.6966667+00:00

No. You do not understood me. You could check the official documentation how Lighthouse works but I will try to explain it in short. You have Tenant A and Tenant B. Tenant A is your tenant and Tenant B is your customer's tenant. Tenant B has subscriptions, let's say Subscription B1. In order to deploy Lighthouse you login to Tenant B and deploy the Lighthouse resources to Subscription B1. The Lighthouse resource contains which tenant (it should be Tenant A) and which user/group from the tenant ( should be tenant A) what kind of built-in RBAC role should have. After the Lighthouse access is deployed. The user to which was given access logins to Tenant A and it can see the subscriptions of Tenant B like they are in their own tenant. So in this example when you login to Tenant A you should Subscription B1.
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-06-20T09:34:22.5966667+00:00

Hello Stanislav,

Thank you, I know how it works :) but as we say in Italy deamon are hiding in details.

I used GUEST accounts of Tenant A to manage customer subscriptions in Tenant B and that does not seem to be working for scenarios in which I have to create VM or storga account for instance.

Are you aware of such a limitation?

Thank you for your help.

beppe
Stanislav Zhelyazkov 23,421 Reputation points MVP

2024-06-20T10:14:51.8033333+00:00

I am not aware.
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-06-20T10:17:04.89+00:00

Thank you very much indeed.

giuseppe

3 answers

Stanislav Zhelyazkov 23,421 Reputation points MVP

2024-06-20T08:21:52.6466667+00:00

I am not experiencing this problem so my conclusion is either you do not have Contributor access, you haven't correctly logged or there are some restrictions on the subscription. You need to login to your own tenant, not the customer one. You can create resources from any blade for example if you search for Virtual machines and open that blade you can create VMs from there by just choosing the subscription of your customer. That is of course if all of the above are correct.
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-07-09T09:34:41.31+00:00

Hello there,

and thank you both. I am now able to correctly operate even when creating things.

One interesting matter to remark in my opinion is the follow.

I granted Contributor access to customer's subscription through a group called SYS.

SYS is of course in the ManagedBy tenant in which I invite guest users. I invited my work account which is name.surname@bt.com and two private account one namesurmane@yahoo.it and the second is namesurname@gmail.com.

Only my work account which is on a Microsoft ExtraID works. This is, anyhow, my desired behaviour hence I will mark your last reply as a successful answer.

Thank you once again and best regards

giuseppe
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
AnuragSingh-MSFT 21,351 Reputation points

2024-07-08T07:32:10.2033333+00:00

@Tristano,G,Giuseppe,JBP12 R, thank you for posting this question. As Stanislav mentioned, this could be only related to insufficient permissions assigned to the user of the ManagedBy tenant to access resources in Managed tenant. I got confirmation from the product team that there is no difference related to whether the user is a Guest user added to ManagedBy tenant. As long as the correct role has been assigned, they should be able to perform the operation - even to create resources.

I even tested it with 2 subscriptions and there was no issue observed. The Guest user was given Contributor access at subscription level in my case to test whether it was able to create the storage account.

Hope this helps.

If the answer helped, please click Accept answer so that it can help others in the community looking for help on similar topics.
Please sign in to rate this answer.
Tristano,G,Giuseppe,JBP12 R 46 Reputation points

2024-07-08T14:35:08.2233333+00:00

Hello,

Thank you for your answer. I even more puzzled now.

I recap:

1 Invite user name.surname@bt.com (our users) as guests on my Management Tenant that a idc.btitalia.it2 I created a group called SYS in which I put all guest users name1.surname1@bt.com, name2.surname2@bt.com...namen.surnamen@bt.com. This group is given Contributor role via Lighthouse on the customers subscriptions

3 these group of users has all the right access but it is unable to create things on customer tenants.

I might be doing a mistake somewhere but I don't know where...

Can we have a session o Teams to do things together?

Thank you for your help

giuseppe

AnuragSingh-MSFT 21,351 Reputation points

2024-07-09T04:57:18.8433333+00:00

Tristano,G,Giuseppe,JBP12 R, thank you very much for the reply.

The easiest way to verify if impacted user/s were granted contributor access to the customer's subscription successfully would be to follow the steps below:

Login to Azure portal using the impacted account

In Azure portal, search for subscriptions --> select the customer's subscriptions.

Click "Access control (IAM)" from subscription resource menu --> "View my access"

If the user does not see "Contributor" as role assignment, then the role was not assigned correctly, or something might have changed.

Please let me know if this helps or if you have any questions.

Stanislav Zhelyazkov 23,421 Reputation points MVP

2024-07-09T05:24:29.4666667+00:00

@AnuragSingh-MSFT The above will work only if you check the access control as another user with access via Lighthouse. If check Access Control as as user from the customer's tenant you will not see it.

AnuragSingh-MSFT 21,351 Reputation points

2024-07-19T06:23:21.5433333+00:00

thank you Stanislav Zhelyazkov, this is what I meant when I mentioned "Login to Azure portal using the impacted account" (which is the account granted access via lighthouse.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Lighthouse

3 answers

Your answer