Why ISVs Should Use Azure Lighthouse

Some MSPs with in-house dev teams can consider themselves ISVs (Independent Software Vendors). This post talks about the benefits of Azure Lighthouse for ISVs.

Windows Azure lets ISVs not only publish their cloud software on the Azure Marketplace, but also monetize from offering services to help their customers operate it. Many companies using cloud services lack the in-house expertise to optimize the deployment, configuration, management, and reporting of their specific cloud services. Azure Lighthouse provides ISVs with an opportunity to upsell managed services on top of their software. As the developer of a piece of software, you are likely to be the world’s leading expert in making it run as efficiently as possible. ISVs have been able to offer managed services through Azure for some time, but one of their major challenges was how to efficiently support every customer who subscribed to their service. In the past, the ISV’s service administrator would have to log in and manage dozens, perhaps hundreds, or even thousands of individual accounts. The administrative overhead alone added significant cost which would often be passed down to the end-users. Azure Lighthouse has provided a solution to allow ISV to centrally manage tasks for all of their tenants from a single interface, which will be detailed throughout this blog. For more information about Azure Lighthouse, check out the Altaro blog series about the Azure Lighthouse solutions, its foundational technologies using ADRM and AAD, Azure integration, and the go-to-market strategy.

Azure Lighthouse Benefits to Independent Software Developers (ISVs)

For a few years, I was an executive for a Microsoft Partner which created security software for Microsoft Azure, Windows Server and System Center. As most ISVs know, being able to publish your software and make it discoverable on the Azure Marketplace is an incredible benefit and it reduces your customer acquisition cost by expanding your audience size. We found that about a third of customers would also purchase our managed services, which included assessment, deployment and ongoing maintenance. Unfortunately, Azure Lighthouse was not available to us back then, so we were required to work with hundreds of customers individually. Our operating procedure was as inefficient as that of any consultant who has to securely manage hundreds of sets of credentials. The onboarding process took days or weeks as we went back and forth with customers over email to be given the correct permissions for each managed resources. Since many of these clients were smaller companies and new to Azure, it was often a frustrating experience for both parties. When you have just signed up a new customer, you want the first interactions with them to be positive so that you can establish trust.

One of the main benefits of Azure Lighthouse is streamlining the onboarding process. If you are an ISV, when you publish your managed services offering, you can specify which of your customer’s resources groups contain your software that you will need access to. You can also use role-based access control (RBAC) to select the minimum type of access your team will need to complete your operations. Microsoft Azure provides over 70 different types of roles, and transparently shows the customer what you will have access to. Since some of your customers may only want your help for the initial assessment or deployment, and others may only want support for operations or maintenance, this gives you and your customers granular control. This means that once a new customer buys your software, and selects the type of managed service(s) they need assistance with, Azure will automatically configure the correct permissions on the appropriate resource groups. Now, you can see your customers’ subscriptions by going to the My Customers page, clicking on Customers.

Through the centralized management provided by Azure Lighthouse, it is now easy for ISVs to scale their operational efficiency, standardize their services, automate operations, increase security and compliance. This is because of the unified view of all managed resources which is now visible through the Azure Portal GUI, or by scripting with Azure PowerShell or Azure APIs. Azure Lighthouse creates a new management layer at the customer level, allowing ISVs to add, sort, and delegate access to all Azure resources which their tenants have permitted them to view, edit, create or delete. This lets you act as the managed service provider of your own software. You can now spend more time on enhancing these managed offerings, adding new core competencies and services, instead of performing repetitive tasks across multiple accounts. These new capabilities from Azure Lighthouse are offered through Microsoft Azure at no cost, although the cloud resources which are consumed are still billed to the ISV or their customer.

Azure Lighthouse offers ISVs new operational efficiencies through automation of repetitive tasks, such as patching their software. Through either the GUI or scripts, you can programmatically perform tasks against thousands of resources at once, provided that they are managed by Azure Resource Manager (ARM). This includes reporting, alerting, querying, servicing, security updates or even running custom scripts to deploy a new service. For example, you can run a global query to discover customer’s virtual machines (VMs) running your software which need to be updated and repair them at scale.

These security enhancements of delegated resource management provided by Azure Lighthouse help both the ISV and their tenants. Since you can use delegated access to manage your customers’ resources, you keep all of your custom scripts or templates under your own management and do not need to run them directly within your tenants’ environment. This means that your customers cannot view any of your proprietary scripts, allowing you to protect their own intellectual property (IP). This also provides stickiness to your services, helping you retain your customers. As an ISV you can now offer more services with less effort, letting you maximize your profits or pass on these cost savings to your customers.

Azure Lighthouse Benefits to the Customers of ISVs

Many Azure users are developers or from smaller organizations without a large IT staff, and a lot are new to Azure itself. Users want to spend their time operating their core business and services, so they often find the task of integrating third-party software to be daunting, distracting, and potentially a security risk if they misconfigure the software. Azure Lighthouse solves these issues by making it easy to find expert consulting services for specific software by the authors of the software itself. Using the Azure Marketplace, Azure customers can easily acquire cloud software like any “app store”, but also easily purchase deployment or management services from trusted providers.

These software customers become “tenants” of the ISV who now act as a service provider. The onboarding process is easy through Azure Lighthouse which uses the Azure Delegated Resource Manager (ADRM) technology to easily and transparently assign management rights to the ISV. While the customer can tweak any of the permissions, one of the benefits they will find is the streamlined onboarding process where they can just review the permissions needed to give the ISV access to operate their new software. An advanced customer can even configure which of the 70+ Azure user roles has access to each of their resources.

Through detailed logging and auditing, customers also have transparency into every action on each resource taken by their ISV. Each tenant is fully isolated from their peers to ensure that actions performed by the ISV on another tenant will not interfere with their systems if the change is unauthorized. The customer still maintains full control of their budget and billing. They can provide their own licenses, get billed directly for services from the ISV, or purchase a service directly through the Azure Marketplace, provided that consumption can be metered through ARM. The customer can see the connected service(s) by navigating to the Service Providers Page, selecting Service Providers Offers and seeing the subscription(s) with the correct offer name.

Ultimately Azure Lighthouse provides a better management experience for ISVs and their customers. Developers can upsell their software by also including deployment and support services. It easily plugs into existing programs and solutions, so now ISVs can spend more time with their customers and less time managing credentials. If you are an ISV who is going to publish their managed services through Azure Lighthouse, make sure that you check out the blog post on the go-to-market strategy so you can learn the best practices to stand out from the crowd.