Microsoft 365 Lighthouse for MSPs

Microsoft 365 Lighthouse is a multi-tenant administration portal provided within the Microsoft 365 admin center, designed specifically for Managed Service Providers (MSPs) who manage multiple customer tenants. Launched in July 2021, it centralizes security, compliance, and device management across tenants, offering a unified view of customer environments. The primary goal is to reduce the operational overhead of managing disparate tenants by providing cross-tenant insights, baseline policy deployment, and incident response capabilities.

Lighthouse has strict licensing prerequisites. The MSP partner tenant must have at least one of the following licenses: Microsoft 365 Business Premium, Microsoft 365 E3, Microsoft 365 E5, or Microsoft 365 F5 Security add-on. Each customer tenant being managed must also have at least one paid license from the same set. Additionally, the customer tenant must have at least 10 active users to appear in Lighthouse. Note: Government clouds (GCC, GCC High, DoD) are not supported. The exam often tests these numbers: minimum 10 users per customer, and specific SKUs.

Lighthouse uses delegated administration via Granular Delegated Admin Privileges (GDAP). The MSP must establish a GDAP relationship with each customer tenant. Once set up, Lighthouse reads data from customer tenants using read-only roles (e.g., Global Reader, Security Reader, Reports Reader). Data flows one-way: from customer tenant to Lighthouse. Lighthouse does not store customer data permanently; it caches aggregated data for up to 48 hours. The data includes user risk, device compliance, MFA status, and threat detections. The MSP can view this data in the Lighthouse dashboard but cannot modify customer data directly unless they have write permissions via GDAP (e.g., Security Administrator).

When an MSP logs into the Microsoft 365 admin center (admin.microsoft.com) and selects Lighthouse, the backend authenticates the partner's GDAP tokens. For each customer tenant with an active GDAP relationship, Lighthouse queries the following endpoints:

The data is aggregated and presented in the Lighthouse UI. The aggregation process runs every 4 hours for most data, but some real-time data (like incidents) may update faster. The cache duration is 48 hours; if a customer tenant becomes unreachable, Lighthouse will show stale data for up to 48 hours before marking it as unavailable.

To set up Lighthouse, an MSP must first establish GDAP with each customer. This is done via the Microsoft Partner Center. Steps:

To verify Lighthouse is working:

Using PowerShell:

# Requires Microsoft Graph PowerShell SDK
Connect-MgGraph -Scopes "Directory.Read.All", "SecurityEvents.Read.All"
# Get managed tenants (requires GDAP)
Get-MgTenantRelationshipDelegatedAdminCustomer

Microsoft 365 Lighthouse is a powerful tool for MSPs to gain visibility and control across customer tenants. The exam focuses on its architecture, licensing, GDAP dependency, baseline management, and comparison with Azure Lighthouse. Understanding the data flow and limitations is critical for answering scenario-based questions.

A Managed Service Provider manages 200 small businesses, each with 10-50 users. Before Lighthouse, the MSP had to log into each tenant's admin center individually to check MFA compliance, device health, and security alerts. This took hours daily. With Lighthouse, the MSP's helpdesk team uses the dashboard to quickly identify tenants with low MFA registration rates. They deploy the MFA baseline to 50 tenants simultaneously, reducing manual effort by 80%. The deployment plan shows exactly which tenants succeeded and which failed (e.g., due to existing Conditional Access policies). The MSP also uses the user risk view to spot compromised accounts across tenants and take immediate action via GDAP. Performance is generally smooth, but the 48-hour cache can cause delays in seeing changes. The MSP learned to wait at least 48 hours before escalating if a tenant doesn't appear after GDAP approval.

A large MSP with 500+ customers uses Lighthouse for cross-tenant monitoring but also needs to delegate management to different teams (e.g., Level 1 support, Level 2 security). They create multiple GDAP relationships per customer with different role sets: Level 1 gets Global Reader, Level 2 gets Security Administrator. Lighthouse respects these roles; a Level 1 technician cannot deploy baselines. The MSP also uses Azure Lighthouse for Azure resource management, but they keep Microsoft 365 Lighthouse separate for M365 workloads. A common misconfiguration they encountered: assigning Global Administrator role via GDAP, which gave too much power and violated least privilege. They now use only the roles required. Additionally, they found that customers with fewer than 10 users are invisible, so they use alternative tools (e.g., custom scripts) for those small tenants.

A security incident (e.g., a phishing campaign) affects multiple customer tenants simultaneously. The MSP uses Lighthouse's Threat Management tab to see all incidents in one place. They filter by severity and identify three tenants with critical incidents. They drill into each incident, link to Defender, and initiate automated investigation. Without Lighthouse, they would have to switch between tenant portals, missing the big picture. The cross-tenant view is crucial for identifying patterns (e.g., same attacker targeting multiple tenants). The MSP also uses Lighthouse to check if any users are marked as high risk across tenants, then force password reset via GDAP with Security Administrator role. One pitfall: if GDAP roles are too restrictive (e.g., no Security Administrator), they cannot take action; they must request elevation from the customer.