Azure Lighthouse
Azure cost optimisation through Azure Lighthouse
Azure Lighthouse gives MSPs delegated access to client subscriptions from their own tenant. Cerberus Cloud builds on that access to find, rank and prove Azure savings across every delegated client.
Book a WalkthroughWhat Lighthouse gives an MSP
With Azure Lighthouse, users in your own Microsoft Entra tenant are assigned roles on delegated customer subscriptions and resource groups. They sign in with their own credentials and work across every customer they have access to, without separate accounts in each client tenant. Onboarding a customer is typically a single ARM template deployment.
Lighthouse itself is available at no additional charge. You still pay for the underlying Azure services you use with it.
What Lighthouse doesn't do for cost
Lighthouse is an access model, not a cost optimisation tool. It gives you a way in; it doesn't tell you which client to work on next or what a change will save.
It also has a hard boundary. Microsoft documents that Lighthouse supports requests handled by Azure Resource Manager, but not data operations handled by a resource instance, such as storage data access or Key Vault secrets. Some monitoring APIs fall on the wrong side of that line, which is easy to miss when you only test against your own tenant. We wrote up what broke for us in production.
For costs, Microsoft describes CSP partners viewing customers' consumption costs at retail rates for each individual subscription. That is spend visibility, not a ranked list of what to fix.
How Cerberus Cloud works through Lighthouse
Cerberus Cloud collects inventory through Azure Resource Graph and metrics through the classic ARM metrics API, both control-plane paths that work fully through delegation. Requests are paced against ARM limits, with retry and backoff, so collection holds up at portfolio scale.
On one production account, that approach collected metrics for 802 resources and wrote 1.6 million metric data points, with 97% succeeding on the first pass and the rest recovered on retry.
- Inventory through Azure Resource Graph
- Metrics through the ARM metrics API
- Read-only Reader and monitoring-read roles
- No agents in client tenants
What your team gets
Cerberus Cloud runs 275+ automated finders across 15 Azure service families over that data and ties each signal to real billing data. Your engineers get a ranked backlog with evidence and remediation scripts to review; your account teams get a savings history for every client.
See how that comes together in the multi-tenant portfolio view.
Frequently asked questions
- Does Cerberus Cloud need data-plane access?
- No. Cerberus Cloud reads inventory, configuration, monitoring and billing metadata only. It does not access resource data planes such as database contents or storage accounts.
- Which roles does Cerberus Cloud need?
- Reader and monitoring-read roles. Microsoft notes that Lighthouse supports built-in roles except Owner and roles with DataActions permissions, so a read-only delegation fits within its limits.
- Is Azure Lighthouse free?
- Yes. Microsoft makes Azure Lighthouse available at no additional charge. You continue to pay for the underlying services you use with it, such as Log Analytics.
- Why not use the Azure Monitor Metrics Batch API through Lighthouse?
- It is a data-plane endpoint, so Lighthouse-delegated permissions don't apply to it and calls fail even when the role would be sufficient. The classic ARM metrics API is control-plane and works through delegation. Read the full write-up
See Lighthouse-based collection on a sample portfolio
A 15-minute walkthrough from tenant connection to prioritised findings, remediation scripts and savings verification.
Sources
Last checked . Product details change; tell us if something here is out of date.