Issues with Role-Based Deletion Restriction & Locks in Azure Lighthouse

Question

I need support for an Azure Lighthouse environment. I set up a test environment with two Azure accounts—one as a service provider and the other as a customer. The Azure Lighthouse environment was successfully set up on both accounts.

I have two security groups in the service provider account, which are used in the template for delegation:

• Storm Internet Support L1
• Storm Internet Support L2

I created a role assignment in the delegation for L2 as Contributor and L1 as Virtual Machine Contributor at the subscription level.

I need to prevent the service provider team from deleting anything on the customer side while still allowing them to create resources. However, even a custom role is not allowed in the Lighthouse environment to enforce this restriction.

I tried using locks, but I encountered strange behavior:

• Locks created by the customer (Owner) are not visible on the service provider side.
• Locks created by the service provider (Contributor) are not visible on the customer side.
• Even if a lock is applied by a Contributor (L2) on a resource group created in the customer account, the customer (Owner) can still delete the resource group because the lock does not appear on their side.
• Similarly, a service provider (Contributor) can delete resources that were locked by the customer (Owner) because the lock does not appear on the service provider side.
• This behavior seems unexpected and inconsistent.

One more thing—I want to edit the directory name on the service provider side. If I have multiple customers, how can I easily recognize them?

Please provide guidance on these issues.

Thanks.

Answer 1

Hi,

You can create policies with deny effect. There already some built-in available. Deny policies are better feature than locks.

Note that customer is not technical term. You have Azure tenants (or Microsoft Entra tenants). This means that a single customer can have multiple Azure Tenants. Customer is more of a legal term. You can rename the Microsoft Entra tenant display name by going to Microsoft Entra blade, click on Properties tab, change and save the name.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.