First, the deployment must be done using a non-guest account in your tenant. The account must have the built-in role of Owner for the subscription being onboarded (or it must contain the resource groups that are being onboarded).
In addition, you will need:
The tenant ID of the service provider’s tenant (where you will be managing the customer’s resources)
The tenant ID of the customer’s tenant (which will have resources managed by the service provider)
The subscription IDs for each specific subscription in the customer’s tenant that will be managed by the service provider – or that contains the resource group(s) that will be managed by the service provider
After meeting these prerequisites, we can start the deployment.