Important
The information in this article applies to Nerdio Manager application-level permissions in the customer tenant only. For details of the permissions model that applies to the MSP tenant, see Azure Permissions and Nerdio Manager.
The Nerdio Manager service principal in the customer tenant needs two kinds of access in order to work:
-
API permissions: application permissions that allow the Nerdio Manager application to call Microsoft Graph and other Microsoft APIs.
-
Directory roles : Microsoft Entra roles that allow the Nerdio Manager application to manage specific areas of the customer's Microsoft Entra directory and its settings.
For each kind of access, Nerdio Manager offers two models: a maximalist model, and a model that conforms to the principle of least privilege (PoLP) for security-conscious organizations. The principle of least privilege holds that users and applications should be granted only the access they need to perform their tasks.
The maximalist models obtain a grant up front that lets Nerdio Manager implement all of its available functions, regardless of whether those features are enabled or required in the customer tenant. The PoLP-compliant models grant only the permissions or roles that are actually required to run the features that are active in the customer tenant. This makes the access that has been granted easier to audit and to understand, and gives you more control over it.
The two settings, and the options available for each, are:
-
API permission model: Classic (maximalist) or Granular (PoLP-compliant). The Granular model works with permission sets: named bundles of API permissions, one for each product area, that you enable only for the features you use. Granular is the default for new accounts from version 7.3 onwards. For details, see API permission model.
-
Directory privilege model: Global Admin (maximalist) or Least Privilege (PoLP-compliant). Under Global Admin, the service principal holds the Global Administrator directory role. Under Least Privilege, that role is replaced by six scoped directory roles: Cloud Application Administrator, Privileged Role Administrator, Exchange Administrator, Compliance Administrator, Authentication Policy Administrator, and Teams Administrator. Depending on the features you configure, further roles can be assigned as well. Global Admin is currently the default for new accounts. For details, see Directory privilege model.
Together, the two settings make up the Access Model property of the account. Three combinations are supported: Classic, In Transition, and Modern. The Granular API permission model is a prerequisite for the Least Privilege directory privilege model, so Least Privilege is available only to accounts that have Granular API access. For details, see Access Model.
Note
The default API permission model changed in v7.3. Before v7.3, new accounts were created with Classic API permissions. From v7.3 onward, Granular is selected by default for new accounts, but you can clear the applicable checkbox in the account creation wizard to use Classicmode instead. Existing accounts keep their current API permission model, unless you choose to migrate them. To migrate accounts, see Migrate accounts to the granular permission model and least-privilege roles. The default directory privilege model, Global Admin, has not changed.
The API permission model determines which Microsoft Graph and other Microsoft API permissions are granted to the Nerdio Manager service principal in the customer tenant, and how those permissions are managed. The following table compares the two options.
|
Aspect |
Classic |
Granular |
|---|---|---|
|
Summary |
Nerdio Manager automatically grants the service principal every API permission that any feature could need, up front. |
The MSP administrator explicitly enables named permission sets for each product area, and the service principal holds only the permissions for the features in use. |
|
What it controls |
The Microsoft Graph, Microsoft Defender, Exchange Online, and Teams application permissions consented to the service principal in the customer tenant. |
The same API permissions, plus centralized feature prerequisite checks in the Nerdio Manager user interface and Public API. |
|
What's granted |
The union of all feature permissions, for example:
Granted whether or not the feature is used. |
Base permissions, always present: Plus only the permission sets that the administrator enables: Entra, Intune, Windows 365 Business, Windows 365 Enterprise, Defender for Endpoint, Defender for Office 365, Exchange Online, SharePoint Online, Teams, Purview, and Secure Score. See Permission sets. |
|
How it's managed |
Automatically. Nerdio Manager keeps the permissions in sync through background jobs (App Permissions Sync and App Permissions Refresh), so the administrator never manages the list. The Reapply Permissions account action shows the difference and restores any missing default permissions. It is available for Classic accounts only. |
Manually, by the MSP administrator: account Settings > Prerequisite Model > Configure sets. Pages are not hidden when requirements are missing. Instead, a warning lists exactly which prerequisites (permissions, licenses, or roles) are not met. The enabled sets are saved on the account, and the user interface flags any drift between the saved sets and the permissions actually present in the tenant. Changes are applied one API at a time, so a failure for one API does not block the others. If a change succeeds only in part, check the job details. |
|
Where it's set |
In the Add Account and Partner Center import wizards, clear the Granular checkbox. Accounts created before version 7.3 that have not been migrated remain Classic. |
Selected by default from version 7.3 onwards in the Add Account wizard and Partner Center import, unless Limited Access Mode is on. Also available through the account-level enable dialog, the bulk migration wizard, and the Public API (beta). |
|
Status |
Legacy; still supported. The default for new accounts before version 7.3. From version 7.3 onwards, new accounts use Classic only if you clear Granular. |
Generally available. The default for new accounts from version 7.3 onwards. |
|
Advantages |
One consent, and everything works; there is no ongoing permission management, and no feature is ever blocked by a missing permission. |
The service principal carries only the permissions for features in use. The granted permissions are transparent and auditable, you control which product areas the service principal can access, and the product explains clearly when a feature is unavailable. |
|
Trade-offs |
The service principal holds considerably more permissions than most tenants use, so Classic does not conform to the principle of least privilege. |
More administrator steps: enabling a feature can require enabling a permission set and granting consent. Permission sets overlap, so clearing one set does not remove permissions that another enabled set still needs. A change can succeed in part, because permissions are applied one API at a time. |
Under the Granular model, each permission set is a named bundle of API permissions for one product area. All of the permissions are application (app-only) permissions. The following table lists the API permissions in each permission set, and the API that each permission belongs to.
To check which permissions are actually granted to the app registration in a customer's tenant, see Verify the API permissions on a customer account's app registration.
|
Permission set |
API permissions |
API |
|---|---|---|
|
Base (always present) |
In US Government cloud tenants, only |
Microsoft Graph |
|
Entra |
|
Microsoft Graph |
|
Windows 365 Business |
|
Microsoft Graph |
|
Windows 365 Enterprise |
|
Microsoft Graph |
|
Intune |
|
Microsoft Graph |
|
Defender for Endpoint |
Microsoft Graph: Microsoft Defender for Endpoint API: |
Microsoft Graph Microsoft Defender for Endpoint API |
|
Defender for Office 365 |
|
Office 365 Exchange Online API |
|
Exchange Online |
Microsoft Graph: Office 365 Exchange Online API: |
Microsoft Graph Office 365 Exchange Online API |
|
SharePoint Online |
Microsoft Graph: Office 365 Exchange Online API: SharePoint Online API: |
Microsoft Graph Office 365 Exchange Online API SharePoint Online API |
|
Teams |
Microsoft Graph: Teams Tenant Admin API: |
Microsoft Graph Teams Tenant Admin API |
|
Purview |
Office 365 Exchange Online API: Exchange Online Protection API: |
Office 365 Exchange Online API Exchange Online Protection API (US Government cloud only) |
|
Secure Score |
Microsoft Graph: Microsoft Defender for Endpoint API: |
Microsoft Graph Microsoft Defender for Endpoint API |
Note
Enabling a feature can require more than one permission set. For example, Intune requires both the Intune and Entra sets, and MFA management and Teams data collection use the Entra set. Permission sets overlap - for example, both Windows 365 sets contain CloudPC.ReadWrite.All - so removing one set does not remove permissions that another enabled set still requires.
The directory privilege model determines which Microsoft Entra directory roles the Nerdio Manager service principal holds in the customer tenant. The following table compares the two options.
|
Aspect |
Global Admin |
Least Privilege |
|---|---|---|
|
Summary |
The service principal in the customer tenant holds the Global Administrator directory role. |
The Global Administrator role is replaced by six scoped Microsoft Entra roles, supplemented with specific Microsoft Graph permissions. |
|
What it controls |
The Microsoft Entra directory roles assigned to the service principal in the customer tenant. |
The same - which Microsoft Entra directory roles the service principal holds. |
|
What's granted |
|
Six directory roles:
Depending on the features enabled, further roles can be added. See Directory roles under Least Privilege. Plus the Entra permission set of Microsoft Graph permissions, which replaces abilities lost with Global Administrator (for example, Owner on the linked Azure subscription is unchanged. |
|
How it's managed |
Assigned once, during account provisioning. There is nothing to manage afterwards, because Global Administrator covers everything. |
Toggled per account. There are two modes:
|
|
Where it's set |
Applied by default at provisioning. In the Add Account and Partner Center import wizards, the Least Privilege checkbox is off by default. The bulk migration wizard also keeps Global Admin unless the administrator turns on Least Privilege. |
In the same wizards, the Least Privileged app roles checkbox appears only when Granular is selected, and is off by default. The Service Principal roles step of the bulk migration wizard has its own toggle, which is also off by default. |
|
Status |
Current default. The default for new accounts. Granular combined with Global Admin is the recommended starting point from version 7.3 onwards. |
Public Preview; opt-in. Requires the Granular API permission model. |
|
Advantages |
The simplest possible model; every feature works without additional role or permission configuration. |
Removes the standing Global Administrator role from the service principal, leaves a narrower and more auditable set of roles, and aligns with Microsoft best practice for least-privileged access. |
|
Trade-offs |
Assigns the broadest available directory role to a non-human identity. Microsoft guidance recommends limiting the number of Global Administrator assignments. |
Switching roles requires the temporary Global Administrator application (Auto mode) or manual steps (Manual mode). The Privileged Role Administrator role can assign other directory roles, including Global Administrator. The model is still in Public Preview. |
The following six roles are always assigned together, in place of Global Administrator. The Owner role on the linked Azure subscription is unchanged in every directory privilege model.
|
Microsoft Entra directory role |
Role template ID |
Why Nerdio Manager needs it |
|---|---|---|
|
Cloud Application Administrator |
|
Manage app registrations and enterprise applications. |
|
Privileged Role Administrator |
|
Assign directory roles (for example, for granular delegated admin privileges (GDAP) setup and role management). This role can assign other directory roles, including Global Administrator. |
|
Exchange Administrator |
|
The |
|
Compliance Administrator |
|
Purview management (the same |
|
Authentication Policy Administrator |
|
Manage authentication-method policies for MFA management. |
|
Teams Administrator |
|
Teams admin center management and Teams solution baselines. |
Important
When Global Administrator is not assigned, enabling Defender for Office 365 requires the additional grant of the Security Administrator role, on top of the six roles listed above. No other feature requires a role beyond those six.
The API permission model and the directory privilege model are independent settings, and together they make up the Access Model property of the account. The Access Model is shown in the Access Model column of the MSP-level Accounts table. The following table shows the three supported combinations.
|
API permission model |
Directory privilege model |
Access Model |
Meaning |
|---|---|---|---|
|
Classic |
Global Admin |
Classic |
The maximalist model for both settings. This is how accounts created before version 7.3 started. From version 7.3 onwards, a new account uses it only if Granular is cleared at creation. |
|
Granular |
Global Admin |
In Transition |
Granular API permissions, but the service principal still holds the Global Administrator role. This is the default for new accounts from version 7.3 onwards. |
|
Granular |
Least Privilege |
Modern |
The PoLP-compliant model for both settings. Least Privilege is offered only once Granular is enabled, and is currently an opt-in Public Preview. |
Important
The Least Privilege option for directory access is available only for accounts that have the Granular API permission setting enabled.
Comments (0 comments)