Azure lighthouse with Sentinel

Question

We have a requirement of managing multiple customers environment with Sentinel and we were made aware about Azure light house.
I want to know when the customer allow us (MSSP) on their Azure subscription what kind of security standards are in place so that we do not have more than what we need. (This came from 1 of the customers as they are not so sure about giving us permissions on their subscription for managing their security).
Also does azure lighthouse means they send the logs directly to us and we get charged for storing the logs instead of customer. How to handle the costing in this case.

Answer 1

Azure Lighthouse is an access delegation service so this can be scoped to only the resource group(s) that you need access to on your customer subscriptions.
You can use RBAC to assign only the level of access required. https://learn.microsoft.com/en-us/azure/lighthouse/how-to/onboard-customer

For Azure Sentinel you may only require access to the resource group where the Log Analytics Workspace is deployed on the customer tenant.

Depending on how you architect your solution will determine the costs, so for example if each customer hosts their own Sentinel service and log analytics workspace then the costs will be on the customer subscription. You can still manage this centrally through your MSSP tenant using Azure Lighthouse.

https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants