One user in org can see Customer relationship in Lighthouse, another can't?

Question

Hi everyone,

My organization is an MSSP and has a customer relationship with another tenant. We've used an ARM Template to create a service offering for our customer to upload to their Azure subscription. Another user and I in our org were configured with the same exact access, but he's able to see it in our Lighthouse My Customers tab (https://portal.azure.com/#blade/Microsoft_Azure_CustomerHub/MyCustomersBladeV2/overview), and I'm not.

We both have the required "Reader" and other access. Do you know why this would be the case?

Thanks!

Answer 1

@Garrett Miller - Welcome to Microsoft Q&A and thanks for reaching out.

Apologies for the inconvenience caused.

A user in the managing tenant should be able to see the customer information as long as the customer are granted the Reader role in when that customer was onboarded to Azure Lighthouse.

For more information on how you can view and manage delegations, please take a look at this document: view-manage-customers

If you are still facing the same issue, please let me know so we can work on raising a support ticket.

Hope this helps.

------------------------------------------------------------------

If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.

Answer 2

Do you have Reader at the tenant level? To the root subscription. You might also try global security reader. https://learn.microsoft.com/en-us/azure/defender-for-cloud/tenant-wide-permissions-management

Answer 3

I found another related article that mentions "Monitoring Reader"

https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/lighthouse-security-baseline#pa-1-protect-and-limit-highly-privileged-users

If not your best best is to open a support case.

Answer 4

So the problem here was found by Microsoft Support, and was twofold:

First, I had to go into the "Directories + subscriptions" area in our Azure subscription, and indeed our client was visible was not checked. Checking this made the customer visible in the "My Customers" view, but we were not yet able to see client data.

Second - Eventually we had to "re-register" the Resource Providers Microsoft.SecurityInsights, Microsoft.OperationalInsights and Microsoft.Insights in both the client tenant and our tenant. After doing this, we were able to see client data flowing in.

Thanks all for the help!