This article guides you through moving customer accounts from the Classic permission model to the granular permission model, and through replacing the Global Administrator role of the Nerdio Manager service principal with least-privilege roles. Migrating reduces the access that Nerdio Manager holds in each customer tenant to what the enabled features need, and gives you more control over, and a clearer audit trail of, that access. For background on the two models, see Account-level Nerdio Manager service principal permissions.
Both approaches are optional and supported. You can keep an account on the Classic model, use the granular model with Global Administrator, or use the granular model with least-privilege roles.
Note
The granular permission model is generally available. The least-privilege roles (Least-Privileged app roles mode) are in Public Preview.
The tasks in this procedure are performed at both MSP and Account levels.
-
The customer accounts exist in Nerdio Manager.
-
To use least-privilege roles, an account must use the granular permission model. The migration wizard can move an account to the granular model and to least-privilege roles in one pass.
Note
The admin consent option in some Modern Work settings is separate from the permission model. It is a fallback for Microsoft Graph limitations, where an API does not support application authentication. Migrating an account does not replace or remove it.
The following Nerdio Manager roles allow you to carry out the tasks in this procedure:
-
MSP Admins, and any other role that includes permission to update accounts, can migrate accounts and change the directory privilege model of an account.
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) with the access levels required to carry out the tasks in this procedure:
-
Accounts: Update allows the user to start the migration wizard and to change the permission settings of an account.
When Nerdio Manager makes the role changes for you (the automatic approach), it creates a temporary application with the Global Administrator role in the customer tenant. It needs this application because a service principal cannot remove the Global Administrator role from itself, which is a Microsoft restriction. The temporary application is not needed when you switch back to Global Administrator.
When you make the role changes yourself (the manual approach), you need a Microsoft Entra account in the customer tenant that can assign and remove directory roles for the Nerdio Manager application.
-
Review the models and the roles involved in Account-level Nerdio Manager service principal permissions.
-
To enable or disable individual features, and the permission sets they need, see Manage customer account-level features and permissions.
-
For accounts that use Limited Access Mode, see Overview of Limited Access Mode.
The Accounts table at the MSP level has an Access Model column that shows how each account is set up:
|
Access Model |
Meaning |
|---|---|
|
Classic |
The Classic permission model and the Global Administrator privilege model. Portal feature validation is off. |
|
In Transition |
Granular API permissions with portal feature validation on, but the service principal still holds the Global Administrator role. |
|
Modern |
Granular API permissions and least-privilege app roles. |
The Migration to new prerequisites model wizard guides you through the changes for one account or for many accounts at the same time. For a bulk migration, the wizard applies your choices to every selected account. It has the following steps: Intro, API permissions, Service Principal roles, and Approval. The API permissions step appears only when at least one selected account still has permissions to migrate.
To migrate accounts:
-
At the MSP level, navigate to Accounts.
-
Select Migrate accounts at the bottom of the accounts table.
-
On the Intro step, read the introduction, which describes the model that the accounts use now. In Accounts, select the accounts to migrate. You can search the list by name, and each account shows its current Access Model. Then select Next.
-
On the API permissions step, review the Permission changes. Each feature now requires a permission set, which is a predefined group of API permissions. Permissions that are not in any required permission set are removed, and permissions that are missing from the required sets are added. Expand the section of each account and application, for example [account name] - Main application, to see the Permissions to add and the Permissions to remove. Then select Next.
-
On the Service Principal roles step, decide whether to move to least-privilege roles. The Roles changes switch is off by default.
-
Off: Least-Privileged app roles mode stays disabled, and the role assignments of the service principal are not changed.
-
On: Nerdio Manager replaces the current roles of the application with the Least-Privileged app roles. The application is assigned the following roles:
-
Teams Administrator
-
Authentication Policy Administrator
-
Exchange Administrator
-
Cloud Application Administrator
-
Compliance Administrator
-
Privileged Role Administrator
-
Expand the section of each account and application to see the Roles to add and the Roles to remove. The role to remove is Global Administrator. Then select Next.
Note
The switch appears only when the choice is optional. For accounts that already use the granular model, the step shows the Roles changes heading without a switch. To leave the wizard without making changes, select Cancel on any step.
-
-
On the Approval step, choose who makes the changes:
-
I approve these changes, please adjust the customer's Service Principal role assignment and application registration API permissions for me. Nerdio Manager makes the role and permission changes for you.
-
The changes have been made, please validate that the customer's configuration aligns with the requirements for transitioning. Select this option when you or the customer have already made the changes. Nerdio Manager checks that the configuration matches what the migration requires.
-
-
Select Apply.
Nerdio Manager creates one task for each account that you migrate. The task is named Migrate account to new prerequisites mode.
To monitor the migration:
-
On the Accounts page, select the Accounts Tasks tab.
-
Locate the task of each account. The table shows the task, the resource name, the user who started it, its status (for example In progress or Complete), and when it was created and completed.
-
To see the progress of a task, select the information icon in the Actions column. The Job Details dialog lists each action of the job with its start and completion time, its status, and its result. Select Close when you are done.
Result: when the tasks complete, the Access Model of each migrated account changes to reflect the new model, for example In Transition for granular permissions with Global Administrator, or Modern when least-privilege roles are also enabled.
You can also change the directory privilege model of a single account from its settings. Switching to least privilege replaces the Global Administrator role of the service principal with the six least-privilege roles that the wizard lists (Teams Administrator, Authentication Policy Administrator, Exchange Administrator, Cloud Application Administrator, Compliance Administrator, and Privileged Role Administrator). You can switch back at any time.
You choose between two ways of making the change:
-
Automatic: Nerdio Manager makes the role changes by using a temporary application, as described in Additional permissions above.
-
Manual: you remove and add the roles yourself in the customer tenant, and then Nerdio Manager validates that the expected roles are assigned before it switches the mode. Use this approach, for example, for accounts in Limited Access Mode.
To switch an account to least-privilege roles:
-
At the Account level, navigate to Settings > Integrations.
-
Scroll down to the Prerequisite Model area. The current mode, Global Admin or Least-Privilege, is shown next to App roles.
-
Select the current mode to change it.
-
To make the role changes yourself, select Don't make these changes for me, I'll make these changes myself. Otherwise leave the checkbox cleared so that Nerdio Manager makes the changes.
-
Confirm the change. If you chose the manual approach, make the role changes in the customer tenant, and then select Validate.
Result: the account's prerequisite role checks accept either Global Administrator or the least-privilege roles, and the Access Model changes to Modern for an account that also uses the granular permission model.
Raise a support ticket for this item.
Comments (0 comments)