Microsoft 365 Lighthouse is a portal built for Cloud Solution Provider (CSP) partners who manage customer tenants. Getting started takes a few minutes, but a handful of eligibility rules and one license decide whether it works. This guide walks through the requirements, the sign-up, the messages you may hit, and how to check that your customers are ready.
Who can use Lighthouse
- You must be enrolled in the Cloud Solution Provider (CSP) program, as an indirect reseller or a direct-bill partner. Your customers don’t need to be enrolled in CSP.
- Lighthouse is deployed in the partner tenant only, never in customer tenants.
- Signing up or enabling the service takes a partner tenant admin.
Licensing
- The partner tenant needs one Microsoft 365 Lighthouse license.
- No per-user licenses are required for the partner.
- No Lighthouse licenses are required in any customer tenant.
Step 1: Try the portal first
Go to lighthouse.microsoft.com and sign in with your partner tenant credentials. If your tenant is eligible and already enabled, you’ll see a welcome message and your managed tenants begin loading. That can take a couple of minutes.
Step 2: Buy the license if prompted
If you see You need to sign up for Microsoft 365 Lighthouse in the Microsoft 365 admin center, a partner tenant admin should:
- Sign in to
admin.microsoft.comwith partner tenant credentials. - Go to Billing > Purchase services > Microsoft 365. Some partners instead use Marketplace > All products and search for Lighthouse.
- Under Microsoft 365 Lighthouse, select Details, then Buy.
- Confirm the license appears under Billing > Your products.
- If you aren’t redirected, return to
lighthouse.microsoft.com.
Step 3: Resolve the other messages
| Message | What to do |
|---|---|
| Microsoft 365 Lighthouse was removed for your organization | A partner tenant admin goes to Settings > Org settings > Services in the Microsoft 365 admin center, selects Microsoft 365 Lighthouse, enables the option that allows Lighthouse customer management experiences, and saves |
| You must be an indirect reseller or direct-bill partner to use this service | Your partner type isn’t eligible. Review Microsoft’s requirements article |
Step 4: Wait for customer data
After sign-up, customer data can take up to 48 hours to appear in Lighthouse. Don’t assume something is broken on day one.
Step 5: Check each customer tenant against the requirements
A tenant needs all of the following to be fully managed. Tenants that don’t meet them get only limited functionality: GDAP setup and management, user search, user details, tenant tagging, and service health.
- Delegated access: a granular delegated administrative privileges (GDAP) or delegated administrative privileges (DAP) relationship. If both exist, GDAP permissions take precedence for technicians in GDAP-enabled security groups.
- Licenses: at least one Enterprise, Business, Frontline, or Education subscription of Microsoft 365, Office 365, Exchange Online, Windows 365 Business, or Microsoft Defender for Business.
- Size: no more than 2,500 licensed users.
- Region: the same geographic region as the partner (Americas, European Union, or Asia plus Australia).
Get the most from the data
- Devices: enroll customer devices in Microsoft Intune and assign compliance policies to all of them.
- Threat protection: devices should run Microsoft Defender Antivirus. It is on by default in Windows 10 and is disabled automatically if a non-Microsoft antivirus is installed.
- User reports: reports such as Risky users, Multifactor authentication, and Self-service password reset need Microsoft Entra ID Premium P1 or later. P1 is included in Microsoft 365 Business Premium and E3; P2 is included in E5.
- Opportunities: viewing them requires the Account Manager role in Lighthouse. Anyone without it needs an Administrator in Lighthouse to assign it.
Next steps
Microsoft’s sign-up guide points to configuring Lighthouse portal security and, if you want Sales Advisor, setting up the required Partner Center roles.
