Permissions and Nerdio Manager

Nerdio Manager is an Azure application that is deployed from the Azure Marketplace and runs inside your own Entra ID tenant and Azure subscription. It requires certain Azure Service Management and Graph API permissions during installation, configuration, and ongoing use.

Installation Permissions

The Entra ID user performing the installation of Nerdio Manager requires the following permissions:

• Global Administrator role in Entra ID.

• Owner role in the Azure subscription.

In the MSP tenant, the Nerdio Manager app registration has the following role:

• Owner role on Azure subscription where Nerdio Manager is installed.

Account Permissions

When adding a new customer account to Nerdio Manager, a Nerdio Manager app registration is created that is assigned the necessary permissions. Only an admin account native to the customer tenant, which holds the appropriate permissions, is able to grant the Nerdio Manager app registration the required permissions.

In the customer tenant, the admin account that is allowed to create the Nerdio Manager app registration needs the following roles:

• Global Administrator role in the Entra ID.

• Owner role on the Azure subscription.

After adding the customer account, the admin account permissions is not used anymore. Nerdio Manager uses the app registration permissions going forward. For a full list of API permissions, please refer to the document.

Limited Access Mode Permissions

Nerdio Manager accounts can be provisioned in what's called a Limited Access mode to restrict permissions granted to the Nerdio Manager enterprise app in the customer's Azure tenant. In addition, existing customer accounts that were not created in limited access mode, can be switched to limited access mode. See Overview of Limited Access Mode for additional information.

Enable Limited Access Mode at the MSP Level

Once you enable the limited access setting at the MSP level, we suggest you replace Directory.ReadWrite.All with Directory.Read.All and add User.Invite.All permission. This action keeps all existing functionality. However, you can also remove Application.ReadWrite.All permission, wherein some functionality like enable REST API, enable Azure runbooks, manage user roles, and assign accounts to global images may not work.

For example, if you have previously enabled REST API, and then enabled limited access, and later disabled REST API, you are able to enable REST API again because the necessary app already exists. However, if you enable REST API for the first time after enabling limited access, Nerdio Manager is not able to create a REST API app registration in AD. Also, Nerdio Manager doesn't show warnings on pages when limited access functionality is enabled.

Enable Limited Access Mode at the Account Level

Nerdio Manager creates an app registration for each account during provisioning. Here are a few points to note:

• If Limited access is disabled, the app has the "Global Admin" role and the following permissions:

  • AuditLog.Read.All, Group.ReadWrite.All

  • Intune specific: DeviceManagementApps.ReadWrite.All

  • Cloud PC specific: CloudPC.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.ReadWrite.All

  • For Intune and Cloud PC: DeviceManagementConfiguration.ReadWrite.All

• If Limited access is enabled, the app registration does not have the "Global Admin" role and has the following permissions:

  • AuditLog.Read.All, Directory.Read.All, Group.Read.All

  • Cloud PC if it's enabled CloudPC.ReadWrite.All, DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementConfiguration.ReadWrite.All

  • Intune permissions can be assigned on the Settings > Integrations page after the account is created.

• Nerdio Manager changes the AD applications during provisioning, so if limited access is enabled, Nerdio Manager assigns at the first step and removes at the second step of provisioning the following permissions: Application.ReadWrite.All, AppRoleAssignment.ReadWrite.All.

• If limited access is enabled, Nerdio Manager displays the limited access icon next to the first step's name:

  

• And the same icon next to the account name on Accounts list:

  

• Hover over the Limited Access icon, to view a tooltip that says: "Account is in limited access mode. User and Group management functionality is limited."

• In Limited Access mode, Nerdio Manager prompts you to assign necessary permissions manually when you enable Intune or Cloud PC from the Settings > Integrations page:

  

• When you disable Intune features, Nerdio Manager displays a list of permissions that can be removed:

  

• Nerdio Manager displays warnings for all the functionality that is not available in limited access mode:

  

Updates

Nerdio Manager updates are released approximately once per month and are deployed from the Updates menu in the Nerdio Manager portal. The update process is performed by an automated script that runs in Azure Cloud Shell in the context of the currently logged in Entra ID user. The update happens in the MSP Entra ID tenant only and nothing changes in the customer tenants.

The Entra ID user roles required to update the Nerdio Manager are:

• Global Administrator role in Entra ID.

• Owner role on Azure subscription.

Ongoing Use Permissions

When the Nerdio Manager application is installed and configured, no user permissions in the customer tenant are required to manage the customer environment via Nerdio Manager. Most actions in Nerdio Manager run on Nerdio Manager on behalf of the app registration.