User attributes let you mark specific users so that Nerdio Manager treats them differently. Two attributes are available: Emergency Access for break-glass accounts that you must always be able to sign in with, and VIP for users who need extra protection. Marking a user adds the user to a built-in group, can exclude the user from Conditional Access policies, protects the user from being offboarded by mistake, and can alert you when an emergency account signs in.
The attributes are intended for MSP and account administrators. Typical scenarios are keeping emergency accounts out of the scope of Conditional Access policies so that they cannot lock you out, and protecting the accounts of executives from accidental offboarding.
The tasks in this article are performed at the Account level, and at the MSP level for group templates and notifications.
The Emergency Access attribute was introduced with Nerdio Manager v7.0, and the VIP attribute with v7.2.
|
Issue/limitation |
Impact |
Mitigation/planned fix |
|---|---|---|
|
Marking a user changes a custom Microsoft Entra attribute, which is stored as a directory extension in the customer tenant. |
Nerdio Manager creates the extension automatically through the MSP application, the first time it is needed. |
No action is required. Check the job details if the attribute does not save. |
|
The built-in Emergency Access Users and VIP Users group templates are read-only. |
You cannot edit or delete them. |
Create your own group template if you need different rules. |
The following Nerdio Manager roles allow you to manage user attributes:
-
Roles that include the attribute permissions, such as MSP Admins and Account Admins, can mark and unmark users.
Following the Principle of Least Privilege (PoLP), you can define one or more Nerdio Manager custom role(s) with the access levels required to manage user attributes:
-
Accounts.UserAttributes.EmergencyAccess allows the user to mark and unmark Emergency Access accounts.
-
Accounts.UserAttributes.VIP allows the user to mark and unmark VIP accounts.
-
Accounts.Users.Update allows the user to save changes to a user's properties, including attributes.
-
The permission to manage protected users allows offboarding and removing VIP users.
To mark a user:
-
At the Account level, navigate to Entra > Users.
-
Locate the user and open the user's properties.
-
Select the Attributes tab.
-
Select Emergency Access, VIP, or both. A check box is unavailable if you do not have the permission for that attribute.
-
Select Save.
Result: the Attributes column of the Users page shows the attributes of the user, for example Emergency Access, VIP. To list only the Emergency Access users, use the filter on the Users page.
A built-in group template named Emergency Access Users is available at the MSP level under Shared Settings > Microsoft 365 > Group Templates. It is a security group with dynamic user membership, based on the rule user.isEmergencyAccess -eq true, so every user that you mark as Emergency Access joins the group in each customer where the template is published. You can also use the isEmergencyAccess property in the rules of dynamic groups that you create at the Account level.
When you open Direct Assign for a Conditional Access policy that has no assignments yet, the Emergency Access Users group is already added to the Excluded Groups list. Policies of other types and saved assignments are not changed. To add the group yourself, select Add Emergency Access Users in the Excluded Groups area. The button is then unavailable. See Intune policy: MSP level general management for the full procedure.
You can create a notification condition that alerts you when an emergency account signs in. Nerdio Manager then creates a notification, and a ticket in your PSA if you have integrated one. See Alerts and notifications.
For a VIP user, the Offboard and remove actions are unavailable, or blocked if you try them, unless you have the permission to manage protected users. A tooltip explains that the user is protected. A built-in VIP Users group template, which you can find in the same place as the Emergency Access Users template, collects them in a dynamic group.
Contact our Sales team for more information about this feature.
Raise a support ticket about this feature.
Comments (0 comments)