Azure Lighthouse - Transparency of delegated AD group

Question

Hi,

i have a customer who want's to see which employees are part of the delegated Azure AD group in our management tenant. This is a requirement of the customer for compliance reasons.

Is there any convinient way to achieve this?

My impression is that Lighthouse requires a certain level of trust and has no functionality for a customer to view who is inside the delegated AD group.

BR

Answer 1

You are correct. What the customer will see is the Security group name(s) on the managing service provider's tenant. They cannot see the names of the members of that security group and there is no way to share these details with inviting the customer in to the service provider's tenant as a guest user and giving them permissions to see the group members - such as a directory reader role.

I would not recommend this however as customers should not have access to a service provider's tenant. So I agree that a level of trust is required, the customer can see the level of access granted to their Azure resources but they are not entitled to see the names of the individual users with this access.

Answer 2

If the employees of the provider performs any actions, you can see the user logged in the Activity log. You can track activity back to the provider employee.