This message was deleted.

Synchronize Management Domain accounts for engineers into the tenant domains in via Microsoft Identity Manager. Log into tenant environment using local replica of the engineer's account. Assign rbac or Jea through groups or use JIT for shadow principals added to kerberos ticket. For reference see Microsoft's "Service Provider Reference Architecture v2" documentation available from MCS.

Thanks for the information!

Not sure i completely understand your question. But, we use Labtech (Connectwise Automate). It is MSP software that allows us access into all our customer environments

If authentication is your issue I'd recommend deploying fas as part of your builds and setting up your own IDP for saml (ADFS) , this way you have a centralised identity. It may be more work for you in the long run though. Given the alternatives, depends how many clients you have.