How to use Lighthouse ?

Azure Lighthouse access begins after onboarding creates a registration definition and registration assignment at the subscription or resource-group scope, with authorizations for principals in the managing tenant.

In the customer tenant, open Service providers and confirm the offer, delegated scope, and role assignments. In the managing tenant, open My customers and ensure the subscription is included under Directories + subscriptions. The user must be a member—not merely an owner—of the security group granted Reader or a suitable built-in role.

Allow up to 15 minutes after onboarding, then refresh the browser or sign in again for an Azure Resource Manager token. If the customer is still missing, run the managed-services definition and assignment list commands at the delegated scope. Empty results mean onboarding must be redeployed or the Marketplace offer delegated again. If both resources exist but an operation is denied, compare the requested action and scope with the assigned role.

Hello Paul

We understand that "Lighthouse not working despite being configured" almost always comes down to one of a handful of known onboarding/access gaps. Here's how I'd triage it. If you can share (a) whether you're the managing (service provider) or customer tenant, (b) how you onboarded (ARM template vs. Marketplace Managed Service offer), and (c) exactly what "not working" looks like (subscription not visible? access denied on an action?), I can narrow it down further.

1. Confirm the delegation actually exists. In the managing tenant run:

az managedservices definition list
az managedservices assignment list

These list the registration definition and registration assignment created by onboarding. If they're empty for the target subscription, the onboarding deployment didn't take effect and needs to be re-run.

2. Give it time / refresh your token. It can take up to 15 minutes after deployment for the portal to reflect the delegation. Force a refresh by signing out/in or refreshing the browser to get a new ARM token before concluding it's broken.

3. Check the most common misconfigurations (from the official onboarding troubleshooting list):

• Users who need to see customer resources must have been granted Reader (or a role that includes Reader) in the authorizations.
• managedByTenantId must NOT equal the onboarded subscription's tenant ID.
• No two assignments at the same scope can share the same mspOfferName.
• The Microsoft.ManagedServices resource provider must be registered on the delegated subscription (usually automatic; register manually if not).
• Authorizations cannot include Owner, roles with DataActions, or roles with restricted actions — these are rejected/unsupported.
• Groups must be Security groups, not Microsoft 365 groups.
• If access was granted to a group, confirm the user is actually a member (group owners aren't automatically members). Nested-group membership can add extra delay.
• Authorizations must not use any deprecated built-in roles — that silently removes access and blocks new delegations.

4. Verify from the customer side. In the customer tenant, go to Service providers → Service provider offers and confirm the offer appears. The customer can also confirm they haven't removed the delegation (they can revoke access at any time).

If you've walked all of the above and it still fails, please post the specific error message that you are getting to assist you further.

References:

• Onboard a customer to Azure Lighthouse (incl. Troubleshooting + Confirm onboarding)
• Azure Lighthouse architecture (registration definition/assignment
• What is Azure Lighthouse?

Hope this helps, If you have any question, please let us know, thank you