Does Azure Lighthouse let me manage Microsoft 365?

No. Azure Lighthouse provides Azure delegated resource management, letting customers delegate Azure subscriptions and resource groups to your tenant. Microsoft 365 workloads are reached through Microsoft Graph, using either an app registration consented in the customer tenant or delegated admin access. Microsoft 365 Lighthouse is a separate offering.

How long does GDAP access last?

A delegated admin relationship is time-bound: the duration must be between one day and two years. It moves through created, approval pending, approved, activating and active, then expiring and expired. It can be configured to auto-extend by 180 days, which is what stops a fleet of relationships all lapsing on their anniversary.

Is app-only access less secure than delegated admin?

It is a different trade. App-only access is not tied to a person, so it survives staff changes and does not need standing admin accounts, and the customer can see and revoke the consent at any time. The risk moves to protecting the application credential, which is why it belongs in a key vault rather than in configuration.

Do I need Global Administrator in my customers' tenants?

No, and you should not have it standing. Granting an application the specific Graph permissions it needs via admin consent, plus an Azure RBAC role on the subscription for deployment work, covers multi-tenant management without a permanent directory-wide admin role.

How to manage Microsoft 365 across many customer tenants

Updated September 10, 20265 min readMarkdown version

Short answer

There are four practical access models: a multitenant app registration consented per customer, which gives app-only API access whose grant does not expire, though its credential still needs rotating; GDAP, which grants time-bound delegated roles to your staff and expires after at most two years; Azure Lighthouse, which delegates Azure resources only and does nothing for Microsoft 365; and Microsoft 365 Lighthouse, a Microsoft console for monitoring customer tenants. Most automation at scale runs on app-only access through a multitenant app, because it does not expire, does not depend on a signed-in admin, and works identically for every tenant.

The four models, and what each actually covers

These are frequently discussed as alternatives to each other. They are not: two of them are about Azure resources, two are about the Microsoft 365 directory, and they overlap only partly.

Multitenant app registration with admin consent: One application registered in your tenant, consented into each customer's tenant by an administrator. Grants app-only permissions to Microsoft Graph. No user signs in, the grant does not expire on a timer, and the same code path works for every customer. What does expire is the application credential itself: a client secret has a maximum lifetime, so rotation is a date you schedule rather than one Microsoft reminds you about. A certificate credential moves the same problem to a longer clock. This is what automation is normally built on.
GDAP (Granular Delegated Admin Privileges): Time-bound, role-scoped delegated access for your staff, in place of the old all-or-nothing partner admin relationship. Relationships are created, approved and become active, then expire. The duration must be between one day and two years, and a relationship can be set to auto-extend by 180 days rather than ending at its expiry date.
Azure Lighthouse: Azure delegated resource management. Customers delegate subscriptions or resource groups to users and roles in your tenant. Microsoft states there is no extra cost and any Azure customer or partner can use it. It covers Azure resources, not Microsoft 365 workloads.
Microsoft 365 Lighthouse: A separate Microsoft offering that helps service providers onboard, monitor and manage Microsoft 365 customers at scale. A console rather than an access mechanism.

Why app-only ends up carrying the automation

Delegated access is tied to a person. Their session expires, their account gets MFA-challenged, they leave the company, and the relationship itself has a hard end date. That is entirely appropriate for a technician doing interactive work, and entirely wrong for a process that has to read every tenant's policy state at three in the morning.

App-only access, using the client credentials flow, has no user attached. The permissions are explicit, granted once per customer by an administrator who can see exactly what is being requested, and revocable at any time from the customer's own enterprise applications list. It is also easier to audit: every call is attributable to one application identity rather than to a shared technician account.

What an MSP should actually check before choosing

Does it expire?: GDAP relationships do, at two years maximum. Plan the renewal or plan the outage.
Does it survive staff turnover?: Anything tied to a named admin account does not.
Is it least privilege?: Standing Global Administrator across thirty tenants is a single credential away from a very bad week.
Can the customer see and revoke it?: An admin-consent grant appears in the customer's own enterprise applications list, where they can review the permissions and remove it without involving you.
Does it cover both planes?: Microsoft 365 governance and Azure deployment are different APIs with different permission models. Most MSPs need both.

The operational problem nobody mentions in the docs

Getting access is the easy part. What breaks at fleet scale is everything after: no consistent baseline across tenants, no way to tell which tenant drifted last week, per-tenant admin centres that do not answer the question 'which of my clients are missing this control', and Graph throttling that turns a fleet-wide read into an afternoon.

That is the actual work. Access is a prerequisite, not a solution.

How rugged.sh does it

rugged.sh uses one multitenant app registration, consented per customer by an administrator, plus the Owner role on the customer's Azure subscription for deployment work. There is no GDAP requirement and no Lighthouse requirement, nothing expires on a two-year timer, and we never ask for standing Global Administrator. Every request carries a partner and customer scope that is enforced at the data layer, so one MSP on the platform cannot see another's tenants.

Questions people ask

Does Azure Lighthouse let me manage Microsoft 365?: No. Azure Lighthouse provides Azure delegated resource management, letting customers delegate Azure subscriptions and resource groups to your tenant. Microsoft 365 workloads are reached through Microsoft Graph, using either an app registration consented in the customer tenant or delegated admin access. Microsoft 365 Lighthouse is a separate offering.
How long does GDAP access last?: A delegated admin relationship is time-bound: the duration must be between one day and two years. It moves through created, approval pending, approved, activating and active, then expiring and expired. It can be configured to auto-extend by 180 days, which is what stops a fleet of relationships all lapsing on their anniversary.
Is app-only access less secure than delegated admin?: It is a different trade. App-only access is not tied to a person, so it survives staff changes and does not need standing admin accounts, and the customer can see and revoke the consent at any time. The risk moves to protecting the application credential, which is why it belongs in a key vault rather than in configuration.
Do I need Global Administrator in my customers' tenants?: No, and you should not have it standing. Granting an application the specific Graph permissions it needs via admin consent, plus an Azure RBAC role on the subscription for deployment work, covers multi-tenant management without a permanent directory-wide admin role.

Sources

Microsoft's behaviour described above was read from these pages on the dates shown. Claims that come from our own testing against a live Azure subscription carry that date inline.

Microsoft Learn: What is Azure Lighthouse? (read September 10, 2026)
Microsoft Learn: delegatedAdminRelationship resource type (GDAP lifecycle and duration) (read September 10, 2026)
Microsoft Learn: Microsoft Graph change notifications (the supported-resources list) (read September 10, 2026)