Welcome to the M365 FM podcast where we explore the people, ideas and technologies shaping the future of work. Microsoft three. Sixty five lighthouse. The free tool. Almost nobody talks about Microsoft three. Sixty five lighthouse is free, and almost nobody outside the IT world talks about it. It's one screen that lets a single IT provider look after Microsoft three hundred sixty five for dozens of small businesses at the same time. That sounds like a small convenience until you see how many companies depend on those providers to stay secure. Welcome to the M365 FM podcast, where we explore the people, ideas, and technologies shaping the future of work. By the end of this, you'll know what lighthouse really does, who it's built for, and the hard limits it runs into. What Microsoft three. Sixty five lighthouse actually is. Start with the word tenant because everything else hangs on it. A tenant is one company's own private slice of Microsoft three hundred sixty five with its own users, mailboxes, files, and settings. When you sign in to your work, email your insider tenant. Even if nobody ever used that word around you. For most of us, Microsoft three hundred sixty five means exactly one tenant, the one we sign into every morning. An IT provider lives inside many. Because dozens of small businesses hire them to run Microsoft three hundred sixty five on their behalf. Microsoft three hundred sixty five lighthouse is the screen that shows all of those tenants together. Instead of opening fifty admin centers in fifty browser tabs, the provider opens one portal and sees every customer side by side. That's the whole idea, and it's worth saying plainly because the name makes it sound more mysterious than it is. Lighthouse isn't a place for deep configuration work. It works more like a control room than a workshop, because the job here is spotting problems and pushing standard fixes, not rebuilding one company set up from scratch. The portal gathers the signals a provider actually needs. It shows tenant health, risky sign ins, device compliance threats, service incidents, and alerts all pulled into one view. Microsoft describes this as proactive account management, simplified onboarding, device protection, and multi-tenant visibility, which is a mouthful, but the plain version is that you stop checking every customer by hand and it doesn't cost anything extra. Microsoft states plainly that there are no additional costs to use lighthouse for managing Microsoft three hundred sixty five services and connected devices, so this isn't a premium add on waiting at the end of a sales call. What makes it matter in practice is the word across. One provider might look after a dentist, a law firm, a small manufacturer, and a chain of coffee shops, and each one has a separate tenant with its own problems. Lighthouse turns that scattered pile into something closer to a fleet, where the provider sees the whole group at once and deals with the same issue everywhere it appears. There's also a newer sales facing side to the portal. Microsoft has added areas that use machine learning to point a partner to what customers who might benefit from more services, including suggestions around copilot adoption. That side is aimed at account managers rather than technicians, and that's part of why people call lighthouse a business tool as much as a security tool. It also brings up the question of who this is actually built for, which is where we go next. Who Microsoft three. Sixty five lighthouse is really built for. Here's the part that surprises people, and it's worth being blunt about. Lighthouse is not built for a single company's own IT team. It's built for partners in Microsoft's Cloud Solution Provider program, which includes direct build partners and indirect resellers. In plain language, those are the companies that sell and manage Microsoft three hundred sixty five. For other businesses, if you've ever worked somewhere small enough that the boss says to call the IT guy, that I.T. guy is very often one of these partners. Lighthouse is the tool working behind the curtain for that kind of job. One detail clears up a common worry the customer businesses don't need to join the Cloud Solution Provider program. Only the partner does. A dentist office that hires an IT provider doesn't have to sign up for anything special, because the whole relationship lives on the provider's side. It helps to picture the scale. A small managed service provider might look after twenty customers, while a larger one could handle several hundred at twenty. You can almost get away with memory and a spreadsheet at several hundred you can't, and the tools built for a single tenant simply don't stretch that far. If that isn't you, then lighthouse isn't the tool for your job, and that's fine. The standard admin center gives you far more depth for a single tenant, and it's where you'd spend your day anyway. Large organizations and big security teams have their own option to the multi-tenant tools inside. Microsoft Defender XDR are built for enterprise scale security work where teams hunt threats across many tenants at once. Lighthouse and those tools aim at different people, and Microsoft's own comparison table makes that split clear. This matters even if you never touch lighthouse, because it explains why the tool looks the way it does every design choice inside. It comes from one problem, which is running the same job across one hundred small customers without losing your mind. What a customer tenant needs before lighthouse can see it, lighthouse can't see a customer tenant on its own. The partner has to be given access first, and the way that access works has changed a lot over the years. The modern approach is called granular Delegated Administrative Privileges, or DAP. The name is heavy, but the idea is simple the customer hands the partner a limited set of admin permissions instead of the master keys to everything. Those permissions cover specific roles, and they carry an expiry date so access doesn't sit open forever. There's an older model called Delegated Administrative Privileges, or DAP, which was broader and blunter. If a tenant has both DAP wins for technicians who sit in DAP enabled security groups, so the tighter model takes priority. Once access is sorted, a tenant still has to clear three more bars. It needs at least one qualifying subscription, such as Microsoft three hundred sixty five, office three hundred sixty five, Exchange Online, windows three hundred sixty five business, or Microsoft Defender for business. It needs no more than two thousand five hundred licensed users. It also has to sit in the same region as the partner, which means the Americas, the European Union or Asia, plus Australia. Those rules aren't random. The seat cap and the region rule keep the tool pointed at small and midsize customers, which is exactly who these partners serve. A giant enterprise tenant with fifty thousand seats isn't the target here, and Microsoft sends that audience somewhere else, miss any of the bars and the tenant doesn't vanish. It drops into a limited experience instead, where the partner can still handle setup, search for users, view user details, tag the tenant, and check service health. Everything richer like device views and risk reports stays locked until the tenant qualifies. Timing catches people out as well. When a tenant does qualify, the data won't appear instantly because Microsoft says a customer tenant's data can take up to forty eight hours to load. A new partner shouldn't panic on day one. There's one more piece that's easy to forget. Access alone isn't enough for some features, because device views depend on devices being enrolled in Intune, and risk views depend on the right identity license. That's where many beginners get confused, and it becomes one of the real limits later, so keep it in your back pocket. How baselines keep every customer on the same standard. If lighthouse had only one idea worth learning, it would be the baseline. A baseline is a standard set of security and compliance settings that a partner pushes out to every customer at once, so each tenant starts from the same safe place. Microsoft ships a default baseline aimed at small and midsize businesses, and it sorts the tasks into six areas identity protection keeps account safe email and apps protection locks down mail and the productivity apps endpoint. Enrollment gets devices into management, and endpoint protection adds the security standards. On top of that, data protection stops sensitive information from leaking and end user experience. Handles training and branding across customers. The point of the default baseline is that it's a starting point, not a final answer. Microsoft tunes it for small and midsize businesses, so it avoids settings that would overwhelm a ten person company, and it stays focused on the protections that actually matter at that size. One deployment task inside that list makes the idea concrete. A single task requires multifactor authentication for administrators, so a stolen password alone isn't enough to take over a customer's tenant. Another task enrolls windows devices into Intune and applies a compliance policy, so a device that drifts out of line gets flagged. The partner doesn't hand-build those settings in every tenant because the baseline applies them across the whole group. Baselines also look at what's already there. Lighthouse scans a tenant compares what it finds against the recommended setup and marks each task as compliant, not compliant, or not licensed. That last label is useful because it tells the partner that a customer simply doesn't own the license a task needs, which turns a technical problem into a business conversation. One word of caution about the word compliance here. It means the tenant matches the recommended setting, not that anyone passed a legal audit. It's a matching check, not a certificate. Partners aren't stuck with Microsoft's version either. They can clone the default tasks and build a custom baseline, which is how a provider makes every new customer look the same on day one. That consistency is the real payoff because the provider defines the standard once instead of remembering how they set up the last forty tenants. That consistency also sets up the honest part of this conversation, since a tool built for breadth always runs into a ceiling somewhere. A baseline isn't a set and forget switch either. Microsoft's own update notes show that when a baseline task changes, tenants can flip to non-compliant until the partner redeploys and partners regularly hit permission snags. When a deployment fails, the tool does the pushing, but a person still owns the result. What a normal week with lighthouse actually looks like. Features are abstract until you see them in motion. So here's a plain walk through a normal stretch of work. It starts with a new customer. The provider Onboards the tenant. The delegated access is in place. The default baseline runs and the tenant appears in the shared list alongside everyone else. From that point on, the provider isn't visiting a new website. Every time the customer's name comes up, the customer is just another row in one place. The morning routine is where the value lands fastest. The provider opens the alerts page and sees what needs attention across every customer at once, instead of clicking through each tenant to find out. Alerts usually appear within minutes of whatever triggered them, and a dismissed alert stays quiet for thirty days unless something new happens on that account. From there, the provider works through the signals, the user's area surfaces, accounts flagged for risky behavior, and the partner can act on several at once rather than one customer at a time. The device compliance view shows which devices across all tenants are healthy, which ones have slipped out of policy, and which settings get missed. Most often, small jobs get easier to like resetting a password or turning on multifactor authentication for many tenants from one screen. There's a rhythm to it that a single tenant never gives you. A problem that appears in one customer usually appears in three others, and because they're all visible in the same place, the provider catches the pattern early instead of discovering it four separate times. Service health rounds out the picture. Lighthouse rolls out Microsoft three hundred sixty five incidents and advisories across customers so the provider knows which customers a service problem touches before the phone rings. Reporting closes the loop. A partner can generate a customer report that summarizes the security posture and the work done in lighthouse, which is exactly what you'd hand over in a monthly or quarterly review. Newer areas go further, using machine learning to suggest where a partner could help a customer next, and to track subscription renewals before they sneak up. The overall effect is that the provider spends less time hunting for work and more time doing it. Instead of asking which customer has a problem this morning, the portal answers that question before the coffee is finished. None of this makes the tool unlimited, and the ceiling is worth understanding before you get too excited. Common mistakes and the honest limits of lighthouse. An honest explanation has to slow down here, because the same design that makes lighthouse useful also creates its ceilings. The tool trades depth for breadth, and that trade shows up in specific places. Start with what it isn't. Lighthouse is not a security operations center because it surfaces security signals but isn't built for the deep. Our. By our threat hunting, a full security team does. If your job is chasing a clever attacker through logs, this isn't the room you do it in. It also doesn't replace the tenant admin center for deep configuration work. The partner still drops into the individual customer's own admin center. Lighthouse is the view across the fleet, not the workbench for one machine. Then there's the human side. Lighthouse is a tool for the IT team that manages the tenants, and it isn't something you hand to end users. It will never show up in their daily work. The hard ceiling comes next. A customer tenant qualifies only up to two thousand five hundred seats, and only if it sits in the same region as the partner. Cross either line, and that tenant falls back to the limited view where most of the useful parts disappear. Lighthouse also leans on Microsoft's other services to do its job. Device views need devices enrolled in Intune with compliance policies assigned risk and password views need a license that includes Microsoft Entry ID, premium, P1 or higher, which comes with Microsoft three hundred sixty five Business Premium and Microsoft three hundred sixty five E3 threat views need devices enrolled and running Microsoft Defender Antivirus. If the customer owns less, lighthouse can show less. Timing is the last big one. Data can take up to forty eight hours to appear after onboarding, and anything changed outside lighthouse isn't picked up until the next scheduled scan or a manual detection run. The picture is accurate, but it isn't always instant. There's a quieter side effect worth knowing, Two lighthouse pulls its information through Microsoft Graph APIs. So if a customer happens to use Microsoft Sentinel for monitoring, that API activity can show up as an incident unless it gets filtered out. It isn't a flaw, but it does surprise you the first time you see it. The mistakes beginners make usually come from the same route. One is assuming that free means effortless when the tool automates the push, but still leaves the decisions, the exclusions, and the follow through with the partner. Another is assuming a customer has to buy something special to appear in lighthouse when the gate is the customer's existing license and size, not an extra lighthouse fee. The trade itself is deliberate, and it isn't a flaw. If you manage three small tenants, lighthouse will feel like overkill if you manage eighty. The alternative is eighty browser tabs and a lot of missed problems, and the breadth wins where lighthouse fits next to Azure Lighthouse and the Admin Center. There are two things named lighthouse in the Microsoft world, and mixing them up is easy, so let's separate them cleanly. Azure lighthouse is a different product with a similar name. It's about managing Azure cloud resources across customers, and it lives inside Azure. Microsoft three hundred sixty five lighthouse is about Microsoft three hundred sixty five tenants, which is the productivity side of things. Your mail, your files, your teams and your devices. The names rhyme, but the jobs don't overlap much. That split mirrors the wider Microsoft three. Sixty five and Azure relationship Microsoft three. Sixty five is where people work every day. Azure is the cloud infrastructure underneath a lot of modern software. Lighthouse lives on the Microsoft three. Sixty five side, and it leans on identity and device services that sit nearby, which is why those license requirements keep mattering against the Tenant Admin center. The difference is direction. The admin center is where you go deep on one tenant. Lighthouse is where you look wide across all of them. One is a deep dive and the other is a wide view. And a provider uses both on the same day against the multi-tenant tools in defender XDR. The difference is audience. Those tools are built for large organizations and security operations teams with unlimited seats and a cap of fifty tenants. Lighthouse is built for partners serving small and midsize customers with unlimited tenants and a cap of two thousand five hundred seats per tenant. It's the same idea of managing many tenants, but aimed at the opposite end of the market. One more practical note ties this together because lighthouse leans on Intune and entry ID, a provider who already uses those services gets more out of it, and a customer who owns less sees less. The tool reflects the stack underneath it. If you want one line to remember, try this one. Lighthouse is the front desk for a fleet of small tenants, not the machine shop for one large one. The recap and one question for you. So the short version goes like this. Microsoft three hundred sixty five lighthouse is a free control room that lets one IT provider manage Microsoft three hundred sixty five for many small businesses at once. It standardizes security with baselines, pulls risky accounts, unhealthy devices and service problems into one place, and saves a mountain of repetitive clicking. It also has real limits because it's built for breadth across many small tenants, with a two thousand five hundred seat cap, a region rule and a reliance on Intune and entry ID to power its best features. So let me put the question to you. If your company hired an outside IT provider tomorrow, would you know how they keep your tenants safe, or would you have no idea if this made the topic feel less intimidating? Subscribe to M365 FM to master the tools and the mindset shaping the future of work.