Using Azure Lighthouse to delegate the Security Operator role to customer tenants

Design solutions for securing privileged access
Answer Correct answer: B — Azure Lighthouse delegates the Security Operator role to Group1 across customer tenants without guest accounts and lets Group2 manage the assignments.

You have a Microsoft 365 tenant that contains two groups named Group1 and Group2. You use Microsoft Defender XDR to manage the tenants of your company’s customers. You need to ensure that the users in Group1 can perform security tasks in the tenant of each customer. The solution must meet the following requirements: • The Group1 users must only be assigned the Security Operator role for the customer tenants. • The users in Group2 must be able to assign the Security Operators role to the Group1 users for the customer tenants. • The use of quest accounts must be minimized. • Administrative effort must be minimized. What should you include in the solution?

  1. multi-user authorization (MUA)
  2. Azure Lighthouse Correct Answer
  3. Privileged Identity Management (PIM)
  4. Microsoft Entra B2B collaboration
azure lighthouse delegated resource management cross tenant security operator minimize guest accounts

Community Votes

B
67%
C
33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Azure Lighthouse delegates roles (such as Security Operator) to a managing tenant's groups across customer tenants with no guest accounts; B2B would require guests and PIM does not span customer tenants natively.

To let Group1 perform security tasks as Security Operator in multiple customer tenants and let Group2 assign that role, with minimal guest accounts and admin effort, use Azure Lighthouse delegated resource management, which grants role assignments in customer tenants without guest accounts.

Choosing B2B collaboration (D) — it would create guest accounts in each customer tenant, contradicting the requirement to minimize guest accounts; Lighthouse avoids that.

Community Discussion (3 comments)

skz94 👍 1 Selected: B
Azure Lighthouse enables cross-tenant management, allowing users in Group1 to be assigned the Security Operator role for customer tenants without needing guest accounts1. Users in Group2 can manage role assignments, including assigning the Security Operator role to Group1 users. It simplifies administrative tasks and provides a scalable solution for managing multiple customer tenants.
agroman09 👍 1 Selected: C
My answer is PIM as it mentions use guest accounts to be minimized.
Mick2024 👍 1 Selected: B
I found this somewhat confusing. It talks of 'a tenant' but further on talks about tenants, so which is it? If its tenants, option B makes sense, but if its tenant, is it not C?

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Azure Lighthouse delegated resource management lets a managing tenant (yours) grant its own groups (Group1) a role such as Security Operator in customer tenants, without creating guest accounts there, and lets Group2 (with the appropriate Lighthouse permissions) assign that role. This minimizes both guest accounts and administrative effort across many customer tenants.

Why the Other Options Are Wrong

B2B collaboration (D) would add guest accounts in every customer tenant, contradicting the 'minimize guest accounts' requirement. PIM (C) governs eligible assignments within a tenant but does not natively delegate roles across external customer tenants. MUA (A) is a backup-authorization control, not a cross-tenant delegation mechanism.

Community Comment Notes

The community favored B (67 votes). Comments explain Lighthouse enables cross-tenant management and role assignment without guest accounts, and that B2B would require guests; a minority (C, 33 votes) confused the guest-account minimization with PIM.

Official Reference

https://learn.microsoft.com/en-us/azure/lighthouse/overview

Related Analysis

Your on-premises network contains an Active Directory Domain

S-Grade

You have an Azure subscription. You plan to deploy multiple

S-Grade

Your company has 10 branch offices. Each office has a local

S-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide