What should a company use to let a consulting firm manage its Azure subscriptions without granting global admin rights?

Azure Lighthouse allows service providers (like consulting firms) to manage Azure resources for their customers (the company) from within their own Azure tenant. This enables cross-tenant management with delegated access, meaning the consulting firm can manage the company's subscriptions without being granted global administrator rights in the company's tenant, adhering to the principle of least privilege. Azure Blueprints define repeatable sets of Azure resources and policies, but they don't facilitate cross-tenant management. Azure RBAC (Role-Based Access Control) is used for managing permissions within a single Azure tenant, not for delegated cross-tenant management. While RBAC is used by Lighthouse to define specific permissions, Lighthouse itself is the overarching service for this scenario. Azure Monitor is for collecting, analyzing, and acting on telemetry data from Azure and on-premises environments; it's not a management delegation tool.