This article guides you through checking the API permissions that are granted to the app registration that Nerdio Manager uses in a customer's Microsoft Entra tenant, so that you can confirm they match the features enabled for the account. Use it when a feature reports that prerequisites are missing, after you change permission sets, or after you migrate an account to the granular permission model. For what each permission set contains, see Account-level Nerdio Manager service principal permissions.
The tasks in this procedure are performed at the MSP level, and in the Azure portal of the customer's tenant.
You need a Nerdio Manager role that allows you to view customer accounts at the MSP level. You also need to sign in to the customer's Microsoft Entra tenant with an account that is allowed to view app registrations there.
To check the API permissions on an account's app registration:
-
At the MSP level, find the account that you want to check.
-
Select the App Registration link for the account.
-
When prompted, sign in to the customer's Microsoft Entra tenant.
The account's app registration opens in the Azure portal, in the customer's tenant.
-
Under Manage, select API permissions.
-
Compare the permissions that are granted with the permissions that are expected for the features enabled on the account. For the permissions in each permission set, see Account-level Nerdio Manager service principal permissions.
Note
The app registration for an account usually follows the naming convention account-web-admin-portal-*, unless the name has been changed.
If a permission that a feature needs is not granted, enable or re-apply the feature's permission set at the Account level, as described in Manage customer account-level features and permissions. After you save your changes, select Refresh cache to pick up the latest permissions information from Azure, and then check the API permissions page again.
Raise a support ticket for this item.
Comments (0 comments)