Multi-tenant Azure cost management
Azure cost management across every client tenant
Cerberus Cloud gives MSPs one place to find, prioritise and prove Azure savings across their whole client portfolio, without reviewing each tenant by hand or installing anything in client environments.
Book a WalkthroughWhy tenant-by-tenant reviews don't scale
Most MSPs start Azure cost work the same way: a senior engineer opens a client's subscriptions when someone asks, works through the portal and exports findings to a spreadsheet. It works for one client. It doesn't work as a service across twenty.
Azure's own tooling keeps the same per-subscription view. Microsoft's documentation describes partners viewing each customer subscription's consumption costs at retail rates through Azure Lighthouse, based on the access they hold for that subscription. That shows what a client spends, not which work across your portfolio will save the most.
One portfolio view
Cerberus Cloud brings spend, findings and recoverable savings for every connected client tenant into a single portfolio view. Service managers can see where the next hour of engineering time will produce the most client value, instead of starting each review from scratch.
- Portfolio spend and recoverable savings
- Findings across every connected tenant
- Ranked by impact, effort and risk
- Savings history per client
Read-only access to each tenant
Each tenant connects through a standard Azure service principal scoped to Reader and monitoring-read roles. No agent is installed, nothing runs on client infrastructure, and the connection can be revoked from the Azure side at any time.
Cerberus Cloud also works through Azure Lighthouse delegation, using control-plane APIs that work fully through delegated access. The security page sets out exactly what it can and cannot see.
From findings to a delivery backlog
Cerberus Cloud runs 275+ automated finders across 15 Azure service families and ties each technical signal to real billing data. Findings arrive ranked by impact, effort and risk, with evidence, implementation guidance and remediation scripts for your engineers to review.
Nothing is applied automatically, so your existing change management and approval controls stay in charge.
Proof your clients can see
Once work is done, Cerberus Cloud keeps the finding and savings history connected. Account teams get a clear record of what was found, what changed and how much value the service delivered, which is what turns a one-off review into a service clients renew.
Frequently asked questions
- Does Cerberus Cloud need write access to client tenants?
- No. Cerberus Cloud uses a read-only service principal with Reader and monitoring-read roles. It cannot create, change or delete client resources.
- Does it work with Azure Lighthouse?
- Yes. Cerberus Cloud collects cost and usage evidence through Azure Lighthouse delegation, using control-plane APIs that work fully through delegated access. How it works with Lighthouse
- How do MSPs usually start?
- Most MSPs start with a two-tenant pilot. A tenant connection typically takes minutes once the read-only service principal is granted, and the pilot can expand without redesigning the delivery process.
- How is multi-tenant pricing calculated?
- In flat monthly bands based on the total Azure spend across the tenants you connect for each client, with no seat limits and no percentage-of-spend charge. See pricing
See a multi-tenant portfolio view in 15 minutes
We'll walk through tenant connection, the portfolio view, prioritised findings and savings verification using a sample Azure environment.
Sources
Last checked . Product details change; tell us if something here is out of date.