Lighthouse

Hello All,

I gave Contributor role (on a subscription) to users via Lighthouse to manage a customer. The users get access with no problem to the customer subscription, can start and stop VM, create a resource group, start and stop backup, etc.

The problem arises when I want to create for instance a storage account (or a new VM). The portal goes to marketplace and then I am not able to add anything else as if I couldn't contact the subscriptions.

Can you please advise.

Thank you in advance for your reply

giuseppe

Stanislav Zhelyazkov 21,851 Reputation points MVP

2024-06-20T06:25:06.62+00:00

Hi,

Can you provide screenshots of the steps you are doing?

Also can you provide screenshots of the access you are seeing available with that user?

If contributor access was given via Lighthouse creating Storage account or VM is not a problem with such access.
Tristano,G,Giuseppe,JBP12 R 21 Reputation points

2024-06-20T08:08:54.5666667+00:00

Hello Stanislav,

I log in with the Contributor (on the customer subscription) user --> I go to Lighthouse --> My customers -->

I click on one of the customer, for instance the second one and I am on their environment.

Then I go to resources --> and I click create

and when I click on create a VM

I end up here, as if I couldn't get to the customer subscriptions.

beppe
Stanislav Zhelyazkov 21,851 Reputation points MVP

2024-06-20T08:21:52.6466667+00:00

I am not experiencing this problem so my conclusion is either you do not have Contributor access, you haven't correctly logged or there are some restrictions on the subscription. You need to login to your own tenant, not the customer one. You can create resources from any blade for example if you search for Virtual machines and open that blade you can create VMs from there by just choosing the subscription of your customer. That is of course if all of the above are correct.
Tristano,G,Giuseppe,JBP12 R 21 Reputation points

2024-06-20T08:26:37.79+00:00

Ah,

My own tenant does not have a subscription, it is only an AAD tenant: I do not think that is a limitation hence I have to create things on a customer subscription.

beppe
Stanislav Zhelyazkov 21,851 Reputation points MVP

2024-06-20T08:39:35.6966667+00:00

No. You do not understood me. You could check the official documentation how Lighthouse works but I will try to explain it in short. You have Tenant A and Tenant B. Tenant A is your tenant and Tenant B is your customer's tenant. Tenant B has subscriptions, let's say Subscription B1. In order to deploy Lighthouse you login to Tenant B and deploy the Lighthouse resources to Subscription B1. The Lighthouse resource contains which tenant (it should be Tenant A) and which user/group from the tenant ( should be tenant A) what kind of built-in RBAC role should have. After the Lighthouse access is deployed. The user to which was given access logins to Tenant A and it can see the subscriptions of Tenant B like they are in their own tenant. So in this example when you login to Tenant A you should Subscription B1.
Tristano,G,Giuseppe,JBP12 R 21 Reputation points

2024-06-20T09:34:22.5966667+00:00

Hello Stanislav,

Thank you, I know how it works :) but as we say in Italy deamon are hiding in details.

I used GUEST accounts of Tenant A to manage customer subscriptions in Tenant B and that does not seem to be working for scenarios in which I have to create VM or storga account for instance.

Are you aware of such a limitation?

Thank you for your help.

beppe
Stanislav Zhelyazkov 21,851 Reputation points MVP

2024-06-20T10:14:51.8033333+00:00

I am not aware.
Tristano,G,Giuseppe,JBP12 R 21 Reputation points

2024-06-20T10:17:04.89+00:00

Thank you very much indeed.

giuseppe

Share via

Lighthouse