While this is unlikely to be employed by a service provider to give host access to tenants, it is worth highlighting that ESXi hosts can be Domain Joined by service provider administrators to allow for centralized authentication and RBAC. Auditing for such a solution can be provided by vRealize Log Insight.