Combining Azure Lighthouse with Microsoft Sentinel’s DevOps capabilities

Hello Javier,

I've been trying to set up a DevOps CI/CD deployment that works across multiple subscriptions and I was wondering if you could help me with an issue that is preventing me from deploying across subscriptions. 

I was able to finish deploying the CI/CD DevOps pipeline from you Sentinel as Code article for the MSSP subscription, and everything works great. When I was setting up the lighthouse connection that would give the MSSP permissions in the customer subscription, I gave the DevOps service connection in the MSSP subscription access to the customer subscription through lighthouse.

I tried running the pipelines with a customer specific variable group and a customer specific YAML pipeline, but no matter how I arrange the configurations I am not able to get the deployment to come through on the customer side. I eventually noticed that there was a function running in the pipeline called "Az-Module" which I did not write that sets the Az-Context for me. I tried defining the Az-Context in the scripts in our GitHub, but the "Az-Module" always overrides the Az-Context. I left an image of the section I am referring to below highlighted in red. 

So what I am asking is...

1. Am I supposed to give the DevOps service connection permissions through lighthouse, or is there another method I should be using?
2. Is there a way to edit the "Az-Module" or prevent it from running so that I can set the Az-Context to point to the customer subscription?

Thanks,

-Nate