The final step is to configure role-based access control (RBAC), so the right people on your team have the right level of access to Nerdio Manager - from full administrators down to help-desk staff who only need to perform specific tasks.
Note
There is an Entra ID limitation that the owner role on a enterprise app is only automatically assigned to a direct user and cannot be assigned to a group using Nerdio Manager. Therefore, admins in Nerdio Manager must be directly assigned so that Nerdio Manager adds the owner role automatically.
You can use role-based access controls (RBAC) to allow users in your organization to sign in to Nerdio Manager and control which actions they can perform once signed in.
The following roles are available:
-
AVD Admin: A user with the AVD Admin role has complete access to all areas of Nerdio Manager. Only AVD Admins can manage users and roles.
-
Desktop Admin: A user with the Desktop Admin role has complete access to user sessions, the ability to view Host Pools, power on/off/restart session hosts, but does not have the ability to add/remove hosts or change any host pool settings. This role also allows for full access to Desktop Images and Scripted Actions.
-
Help Desk: A user with the Help Desk role has access to manage user sessions only.
-
Reviewer: A user with the Reviewer role has view-only access to all areas of Nerdio Manager. They cannot make edits and save changes.
-
End User: A user with the End User role can view and manage their own sessions (message, sign out, disconnect). Personal desktop users can restart, power off, and power on their personal desktops.
For more information about custom roles, see Role-based Access Control (RBAC) Custom Roles.
Nerdio Manager enables you to view the configured role based access role assignments.
To show RBAC role assignments:
-
Navigate to System > RBAC > Assignments. The list of users and their RBAC role assignments are displayed.
Note
-
The search section at the top allows you to search by various fields, including name, username, role, and Workspace.
-
You can have the system list up to 1,000 rows on a single page. This is particularly useful when you are looking at a list of end users, which can often be hundreds or thousands.
-
Select the down arrow next to Edit to display an action menu.
You can add users to Roles/Workspaces.
To add users to Roles/Workspaces:
-
Navigate to System > RBAC > Assignments.
-
Do the following:
Select New Assignment.
-
In the Add Role dialog box, enter the following information:
-
Role: From the drop-down list, select a role.
-
Users/Groups: From the drop-down list, select the users/groups you wish to grant access to.
-
AVD Tenant: From the drop-down list, select the AVD tenant(s) you wish to grant access to.
-
Workspace: For Workspaces roles, from the drop-down list, select the Workspace(s) the user should have access to.
-
Images: For Desktop Images roles, from the drop-down list, select the Desktop Image(s) the user should have access to.
-
Host Pools: For Host Pool roles, from the drop-down list, select the Host Pools(s) the user should have access to.
-
-
Once you have entered all the desired information, select OK.
Note
-
The changes are logged as a task. You can review the task's status to ensure the task completed successfully.
-
Once access has been granted, users may sign in to Nerdio Manager using their Entra ID username and password. Simply share the URL for Nerdio Manager from your browser's address bar with the user. If MFA is being enforced, the user needs to go through the MFA process while signing in.
-
You can change a user's role or the Workspaces the user has access to.
To edit a user:
-
Navigate to System > RBAC > Assignments.
-
Do the following:
Locate the user you wish to edit, and select the edit
icon.
-
Once you have made the changes, select OK.
Note
The changes are logged as a task. You can review the task's status to ensure the task completed successfully.
You can prevent a user from accessing Nerdio Manager by removing the user's access.
To remove a user's access:
-
Navigate to System > RBAC > Assignments.
-
Do the following:
Locate the user you wish to remove access from, and from the more actions
menu, select Remove access.
-
-
On the confirmation window, select OK.
Note
The changes are logged as a task. You can review the task's status to ensure the task completed successfully.
You can create custom role definitions to control access to all areas of Nerdio Manager. Custom roles define the scope and level of access and can be assigned to users and security groups. Users can access modules in read-only or manage mode.
To create a custom role definition:
-
Navigate to System > RBAC > Definitions.
-
Select New Definition.
-
Enter the following information:
-
Name: Type the custom role's name.
-
Description: Type a description of the custom role.
-
Modules: Select all the applicable modules and modes.
Table 1.
Module
Modes
OBSERVABILITY
Insights
-
Read Only: Provides users with read-only access to the Insights dashboards.
-
Manage
Observability > Advisor > Modeler
-
Read Only
-
Manage
Observability > Advisor > Recommendations
-
Read Only
-
Manage
Observability > Advisor > Rules
-
Read Only
-
Manage
AVD & SESSIONS
Workspaces
-
Read Only
-
Manage
-
Manage hosts: Allow users to manage hosts within assigned host pools.
-
Manage assignments: Allow users to manage assignments within assigned host pools.
-
Manage sessions: Allow users to manage sessions within assigned host pools.
-
Manage power state: Allow users to manage the power state of the sessions within assigned host pools.
-
Manage drain mode: Allow users to manage the drain mode of the sessions within assigned host pools.
-
Run scripted actions: Allow users to run scripted actions within assigned host pools.
-
Console Connect Operator: Allows users to manage Console Connect roles.
Desktop images
-
Read Only
-
Manage
App attach
-
Read Only
-
Manage
Portal
-
Manage
ENDPOINT MANAGEMENT
Intune (Global Roles)
-
Read Only
-
Manage
Intune (Read Only Roles)
-
Read Devices
-
Read Policies
-
Read Applications and App Policies
-
Read Update Rings and Policies
-
Read Scripts
-
Read BitLocker
-
Read Antivirus
-
Read User Experience
-
Read User Groups
-
Read Device Location
-
Read Approvals
Intune (Manage Roles)
-
Manage Devices
-
Manage Devices Privileged
-
Manage BitLocker
-
Manage Antivirus
-
Manage Device Groups
-
Manage User Groups
-
Manage Locate Device
-
Manage Policies
-
Manage Applications and App Policies
-
Manage Update Rings and Policies
-
Console Connect Operator
-
Manage Approvals
-
Manage Scripts
-
Manage Microsoft licenses
Intune > Windows 365
-
Read Only
-
Manage
APP MANAGEMENT (UAM)
UAM > Deployment policies
-
Read Only
-
Manage
UAM > App groups
-
Read Only
-
Manage
UAM > Unified catalog
-
Read Catalog
-
Manage Catalog: Allow users to manage UAM catalogs and perform tasks such as importing and deploying apps.
-
Manage Shell App Parameters: Allow users to manage Shell App parameters.
AUTOMATION
Scripted actions
-
Read Only
-
Manage
Scripted sequences
-
Read Only
-
Manage
Scripted sequences > executions
-
Read Only
-
Manage
Task worker analytics
-
Read Only
-
Manage
STORAGE
Cloud desktops > Storage > Azure Files
-
Read Only
-
Manage
-
Manage Profiles: Allow users to manage FSLogix profiles without the need for an active user session and without the need to provide full control to the file share.
Cloud desktops > Storage > Azure NetApp Files
-
Read Only
-
Manage
Cloud desktops > Storage > Log Analytics
-
Read Only
-
Manage
OPERATIONS
Monitoring
-
Read Only
Logs
-
Read Only
Migrate
-
Read Only
-
Manage
Secure variables
-
Read Only
-
Manage
-
Show Secret
-
-
-
Once you have entered all the desired information, select OK.
Note
From the list of definitions, you can edit or delete a custom role.
For more information, see Role-based Access Control (RBAC) in Nerdio Manager.
When using one of the built-in accounts, administrative access to Nerdio Manager is controlled by individual user or group assignment to Nerdio Manager's application registered in Entra ID. As of Nerdio Manager v6.4, support for Cumulative RBAC has been introduced for custom roles. Please review this document carefully to understand the implications of this change. Details on the new and previous behavior are described below.
While it is possible for a user to be entitled to Nerdio Manager through multiple group memberships, this is not a supported configuration if using built-in accounts, or a combination of built-in accounts and custom roles. Care should be taken to ensure that users only have one assignment granting access to Nerdio Manager if using built-in accounts.
Note
The behavior described here is default for new installations of Nerdio Manager. For existing installs, if cumulative RBAC functionality is desired, this must be enabled by the app service setting Features:CumulativeRbac with a value of True.
With the release of Nerdio Manager v6.4, the concept of cumulative RBAC has been introduced for custom roles. This new functionality allows for different permissions, which may be assigned via separate individual assignments user or group memberships, to be applied cumulatively within the Nerdio Manager console.
Where conflicts are present within the assigned roles, the higher permission assignment is applied. Ensure the permissions you assign to users and groups via custom roles meet or exceed your organization’s security requirements.
Note
Multiple direct assignments are not supported. A single direct assignment may be combined with multiple indirect (group) assignments. This new functionality applies only to custom roles defined within the Nerdio Manager application. Built-in roles are fully excluded from this new functionality.
Core Permission Assignment Principles
The following are the core principles related to how the permission assignments apply through Entra ID and how Nerdio Manager interprets them.
-
Users can be assigned directly to the application with a specific role and workspace combination, or they can be a direct member of a group that is assigned to the application. Assignments as both a user and group member are supported
-
Members of a group that is a nested member of another group, which is assigned to the Entra ID application, are not considered. This is an Entra ID limit. See this Microsoft article for details.
-
Nerdio Manager's built-in default roles are arranged in order of tiers with decreasing permission. If a user is a member of groups with multiple equivalent built-in role tiers, then Entra ID only provides one of those assignments to Nerdio Manager. In general, it is provided alphabetically, so the first alphabetical group's assignments apply in most situations, but technically it can be processed in any order.
Additional Principles
-
Nerdio Manager’s Custom Roles provide a filtered experience at the application level. Therefore, custom roles provide the ability to assign one or more custom roles via direct assignment or group membership, and these roles are combined within the Nerdio Manager application to provide the most permissive set of permissions.
-
A direct user assignment is considered the highest priority. Therefore, any user directly assigned to Nerdio Manager is assigned before other permissions that may be assigned by groups.
Example Scenario
-
A user’s account is a member of ABC-ADM Group and DEF-ADM Group.
-
ABC-ADM Group is nested underneath the group XYZ-NerdioSupport-Admin.
-
ABC-ADM Group is assigned to workspace A with a custom role in Nerdio Manager.
-
DEF-ADM Group is assigned to workspace B with a custom role in Nerdio Manager.
-
XYZ- NerdioSupport- Admin is assigned to workspaces C and D as an AVD Admin in Nerdio Manager.
-
The nested membership plays no role. Therefore, as far as Entra ID is concerned, the ABC-ADM Group as a member of XYZ-NerdioSupport-Admin does not exist. Only users that are direct members of the XYZ- NerdioSupport- Admin group are considered. Since the user is not a direct member of XYZ-NerdioSupport-Admin, they do not have access to workspaces C or D.
-
Since the user is a direct member of both ABC-ADM Group and DEF-ADM Group, and both of those groups are assigned to a custom role, therefore, the same tier of permissions per Entra ID, then the effective permissions of the user is going to be the cumulative total of the permissions assigned to the ABC-ADM Group and DEF-ADM Group.
Feature Limitations
In this initial release of the cumulative RBAC feature, there are some functional limitations. These will be addressed in the future where possible.
-
Built-in roles are not supported for this feature. Only custom roles may be used.
-
The feature does not support mixing of different access levels to the workspace module across separate assignments. For example, you cannot mix the ‘Manage Hosts’ and ‘Manage Sessions’ permission in the workspaces module across separate assignments, because only one access level for the workspaces module is supported globally.
-
You cannot mix limited permissions with Full Access, even when restricting the scope to specific workspaces, because the Full Access user interface would conflict with the limits set.
-
You cannot mix limited permissions with Read Only, even when restricting the scope to specific workspaces, because the Read Only user interface would conflict with the limits set.
-
The maximum supported number of assignments is 10. Additional assignments are filtered out.
This section discusses the situation where a user is potentially a member of different groups for environments prior to v6.4. Some of these may be direct assignments or a nested group assignment.
-
The groups are assigned to different custom roles. For example, two assignments grant access to workspace A with varying custom permissions (that is, the same workspace), and one assignment grants access to workspaces B, C, and D.
-
When the user signs in, they only see the workspace A. They do not see workspaces B, C, and D.
-
In fact, you want the user to have access to all the workspaces (A, B, C, and D).
Core Permission Assignment Principles
The following are the core principles related to how the permission assignments apply through Entra ID and how Nerdio Manager interprets them.
-
User assignment to Entra ID applications does not support nested group membership. That is, users can only be assigned directly to the application with a specific role and workspace combination, or they can be a direct member of a group that is assigned to the application. Assigned as both a user and group member is supported, but Nerdio Manager prioritizes the user assignment first (see below).
-
Members of a group that is a nested member of another group, which is assigned to the Entra ID application, are not considered. This is an Entra ID limit. See this Microsoft article for details.
-
Nerdio Manager's built-in default roles are arranged in order of tiers with decreasing permission. If a user is a member of groups with multiple equivalent role tiers, then Entra ID only provides one of those assignments to Nerdio Manager. In general, it is provided alphabetically, so the first alphabetical group's assignments apply in most situations, but technically it can be processed in any order.
Additional Principles
-
All custom roles created in Nerdio Manager are considered to be the same tier in terms of Entra ID's role permissions. Nerdio Manager can not merge or consolidate permissions to enable access to the most permissive combination.
-
Even if there was a custom role that enables all permissions, and a second role that only includes a single permission, because they are both considered to be a custom role, they are equal on the same tier from the perspective of the Azure application.
-
A direct user assignment is considered the highest priority. Therefore, any user directly assigned to Nerdio Manager bypasses any alternate permissions that may be assigned by group. However, users should only have a single assignment, otherwise it is subject to the same processing challenges as multiple group memberships.
Example Scenario
-
A user’s account is a member of ABC-ADM Group and DEF-ADM Group.
-
ABC-ADM Group is nested underneath the group XYZ-NerdioSupport-Admin.
-
ABC-ADM Group is assigned to workspace A with a custom role in Nerdio Manager.
-
DEF-ADM Group is assigned to workspace B with a custom role in Nerdio Manager.
-
XYZ-NerdioSupport-Admin is assigned to workspaces C and D as an AVD Admin in Nerdio Manager.
-
The nested membership plays no role. Therefore, as far as Entra ID is concerned, the ABC-ADM Group as a member of XYZ-NerdioSupport-Admin does not exist. Only users that are direct members of the XYZ-NerdioSupport-Admin group are considered. Since the user is not a direct member of XYZ-NerdioSupport-Admin, they do not have access to workspaces C or D.
-
Since the user is a direct member of both ABC-ADM Group and DEF-ADM Group, and both of those groups are assigned to a custom role (therefore, the same tier of permissions per Entra ID), then the effective permissions of the user is going to be a toss up between what workspaces/pools those groups are assigned to. In this example, that is either workspace A or workspace B.
-
Typically, the assignment is done alphabetically, but there is no official definition of how that is interpreted by Entra ID. Therefore, today, the user could see the workspace A that is enabled by ABC-ADM Group. Tomorrow, the user may see workspace B that is enabled by DEF-ADM Group. Entra ID makes the evaluation and provides the user with access to Nerdio Manager under that group. Nerdio Manager just sees that a member of a specific group has signed in, and grants the permissions accordingly.
Note
This could also apply to two different RBAC role assignments in Nerdio Manager, where two different groups are assigned to the same workspace (for example, workspace A), but have two different custom role definitions. One assignment may be grant permissions to one set of host pools, while the other group may be assigned to a different set of host pools.
Because all custom roles are on an equivalent tier, the specific host pools visible to the user may change depending on which group evaluation Entra ID makes when signing in to Nerdio Manager.
Recommendations
Tip
Be sure to follow these recommendations to ensure a clear and consistent experience.
-
Option #1: Either modify the group membership or assignments used to grant the user access to Nerdio Manager, so that there is only one group membership applied with a single custom role granting access to all the requisite workspaces that the user should have entitled.
Note
Not having multiple groups for Entra ID to evaluate ensures only the single correct assignment is applied.
-
Option #2: Assign the user's account explicitly, not as group membership, to the custom role directly, and grant access to all workspaces that should be entitled.
Note
Having a single direct assignment ensures that the exact required permissions are applied.
Tip
While either solution would work, we would recommend using Option #1. This helps prevent bloating the permission listing with a large number of individual users.
Comments (0 comments)