Abstract: Methods, systems, apparatuses, and computer program products are described herein that enable a service provider to manage cloud resources deployed to different customer environments, residing in different tenants of a cloud services platform using a single access token. The service provider publishes templates that specify service provider permissions with respect to cloud resource deployments. By deploying such a template, a customer authorizes the service provider to manage cloud resources deployed to the customer's environment. In particular, the deployment causes an access token granted to the service provider to be associated with the customer cloud resources. When the service provider logs into his environment, the access token is provided to the cloud resource manager.