Using Azure Lighthouse to delegate the Security Operator role to customer tenants

SC-100 By islever Editorial Last updated

Design solutions for securing privileged access

Short answer

B Azure Lighthouse delegates the Security Operator role to Group1 across customer tenants without guest accounts and lets Group2 manage the assignments.

Question

You have a Microsoft 365 tenant that contains two groups named Group1 and Group2. You use Microsoft Defender XDR to manage the tenants of your company’s customers. You need to ensure that the users in Group1 can perform security tasks in the tenant of each customer. The solution must meet the following requirements: • The Group1 users must only be assigned the Security Operator role for the customer tenants. • The users in Group2 must be able to assign the Security Operators role to the Group1 users for the customer tenants. • The use of quest accounts must be minimized. • Administrative effort must be minimized. What should you include in the solution?
  1. multi-user authorization (MUA)
  2. Azure Lighthouse Correct Answer
  3. Privileged Identity Management (PIM)
  4. Microsoft Entra B2B collaboration

Key Takeaways

Azure Lighthouse delegates roles (such as Security Operator) to a managing tenant's groups across customer tenants with no guest accounts; B2B would require guests and PIM does not span customer tenants natively.

To let Group1 perform security tasks as Security Operator in multiple customer tenants and let Group2 assign that role, with minimal guest accounts and admin effort, use Azure Lighthouse delegated resource management, which grants role assignments in customer tenants without guest accounts.

Common mistake: Choosing B2B collaboration (D) — it would create guest accounts in each customer tenant, contradicting the requirement to minimize guest accounts; Lighthouse avoids that.

Expert Analysis

Why the Answer Is Correct

Azure Lighthouse delegated resource management lets a managing tenant (yours) grant its own groups (Group1) a role such as Security Operator in customer tenants, without creating guest accounts there, and lets Group2 (with the appropriate Lighthouse permissions) assign that role. This minimizes both guest accounts and administrative effort across many customer tenants.

Why the Other Options Are Wrong

B2B collaboration (D) would add guest accounts in every customer tenant, contradicting the 'minimize guest accounts' requirement. PIM (C) governs eligible assignments within a tenant but does not natively delegate roles across external customer tenants. MUA (A) is a backup-authorization control, not a cross-tenant delegation mechanism.

Community Comment Notes

The community favored B (67 votes). Comments explain Lighthouse enables cross-tenant management and role assignment without guest accounts, and that B2B would require guests; a minority (C, 33 votes) confused the guest-account minimization with PIM.

Official Reference

https://learn.microsoft.com/en-us/azure/lighthouse/overview

This link opens the official vendor documentation in a new tab.

Community Votes

B
67%
C
33%

67% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. skz94 👍 1 Answered B
    Azure Lighthouse enables cross-tenant management, allowing users in Group1 to be assigned the Security Operator role for customer tenants without needing guest accounts1. Users in Group2 can manage role assignments, including assigning the Security Operator role to Group1 users. It simplifies administrative tasks and provides a scalable solution for managing multiple customer tenants.
  2. Mick2024 👍 1 Answered B
    I found this somewhat confusing. It talks of 'a tenant' but further on talks about tenants, so which is it? If its tenants, option B makes sense, but if its tenant, is it not C?
  3. agroman09 👍 1 Answered C
    My answer is PIM as it mentions use guest accounts to be minimized.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide