Nerdio Manager is an Azure application that is deployed from the Azure Marketplace and runs inside your own Entra ID tenant and Azure subscription. It requires certain permissions during installation, configuration, and ongoing use.
Tip
See the following document for a deep dive into the Azure permissions and Nerdio Manager: Nerdio Manager for Enterprise - Permissions.
The Entra ID user performing the installation of Nerdio Manager requires the following permissions:
-
Global Administrator role in Entra ID.
-
Owner role in the Azure subscription.
Note
These elevated permissions are needed only for the initial installation and configuration process, and are not necessary for the ongoing use of Nerdio Manager.
When Nerdio Manager is installed, it has the following API application permissions in Azure:
While activating Nerdio Manager licensing subscription, a new SaaS subscription object Azure resource is created on the Azure subscription, which allows Nerdio Manager to charge for license consumption as a 3rd party service on the Azure bill. In order to configure a SaaS subscription object, because it causes additional costs to be included on the subscription, the user completing the configuration must be a subscription owner.
A new Entra ID application registration specific for Nerdio Manager's billing is also created automatically as part of the resource deployment. This application is granted the below permissions in order to authenticate as your user on behalf of your Azure tenant, and register the SaaS subscription object as being tied to your Azure subscription. These permissions allow the billing application to inform Nerdio Manager's licensing service the following details:
-
Who is completing the purchase.
-
Which SaaS subscription object is used for billing.
-
Which Entra ID tenant you are connecting from.
Note
These are the same permissions being granted to the billing application as are granted to the primary Nerdio Manager application above.
|
Service |
Permission |
Function |
|---|---|---|
|
Microsoft Graph |
openid, profile, User.Read (delegated) |
Allows user sign in (name & Azure tenant ID are shared). |
Once the Nerdio Manager application is installed, there are several configuration actions that can be taken inside of Nerdio Manager to "link" it to existing Azure resources or create new ones. These actions require the requesting user (that is, the user signed in and performing the action via Nerdio Manager) to have certain permissions on the Azure resources that are being used.
When the Nerdio Manager application is installed and configured, no user permissions in Azure are required to manage the configured AVD environment via Nerdio Manager. Most actions in Nerdio Manager run on Nerdio Manager on behalf of the signed in user.
Note
There are several RBAC roles available. See Role-based Access Control (RBAC) in NME for details.
Comments (0 comments)