Azure Permissions and Nerdio Manager

Nerdio Manager is an Azure application that is deployed from the Azure Marketplace and runs inside your own Entra ID tenant and Azure subscription. It requires certain permissions during installation, configuration, and ongoing use.

Installation Permissions

The Entra ID user performing the installation of Nerdio Manager requires the following permissions:

• Global Administrator role in Entra ID.

• Owner role in the Azure subscription.

When Nerdio Manager is installed, it has the following API application permissions in Azure:

Service	Permission	Function
Azure Resource Manager	Subscription Reader Subscription Backup Reader	List the available resources in the Azure subscription and make requests on behalf of the user.
Microsoft Graph	Application.Read.All (delegated) AppRoleAssignment.ReadWrite.All (delegated) Application.ReadWrite.All (delegated)	Manage the Nerdio Manager application service principal and assign the users to the Nerdio Manager application to enable user sign in.
Microsoft Graph	Organization.Read.All (delegated) Organization.Read.All (application)	Read organization-level information, such as tenant name.
Microsoft Graph	User.Read (delegated) User.ReadBasic.All (delegated) User.Read.All (application) User.Read.All (delegated) Group.Read.All (application) Group.Read.All (delegated) GroupMember.Read.All (delegated)	Read the Entra ID groups and membership for app group assignments.
Microsoft Graph	Offline_access (delegated) Openid (delegated) profile (delegated) (Optional) Mail.Send (delegated)	Allow user sign in and delegated actions.
Azure Service Management	user_impersonation (delegated)	Make requests to Azure on behalf of the user.
Windows Virtual Desktop	TenantCreator (application)	(AVD Classic/V1) Create the AVD tenants.
Windows Virtual Desktop	user_impersonation (delegated)	(AVD Classic/V1) Make requests on behalf of the user.

Subscription Permissions

While activating Nerdio Manager licensing subscription, a new SaaS subscription object Azure resource is created on the Azure subscription, which allows Nerdio Manager to charge for license consumption as a 3rd party service on the Azure bill. In order to configure a SaaS subscription object, because it causes additional costs to be included on the subscription, the user completing the configuration must be a subscription owner.

A new Entra ID application registration specific for Nerdio Manager's billing is also created automatically as part of the resource deployment. This application is granted the below permissions in order to authenticate as your user on behalf of your Azure tenant, and register the SaaS subscription object as being tied to your Azure subscription. These permissions allow the billing application to inform Nerdio Manager's licensing service the following details:

• Who is completing the purchase.

• Which SaaS subscription object is used for billing.

• Which Entra ID tenant you are connecting from.

Service	Permission	Function
Microsoft Graph	openid, profile, User.Read (delegated)	Allows user sign in (name & Azure tenant ID are shared).

Configuration Permissions

Once the Nerdio Manager application is installed, there are several configuration actions that can be taken inside of Nerdio Manager to "link" it to existing Azure resources or create new ones. These actions require the requesting user (that is, the user signed in and performing the action via Nerdio Manager) to have certain permissions on the Azure resources that are being used.

Action	Permissions Required
Link a resource group	The requesting user must be an Owner on the resource group being linked.
Link a network	The requesting user must be an Owner on the vNet that is being linked (or the resource group that contains the vNet).
Link an additional Azure subscription	The requesting user must be an Owner on the subscription that is being linked.
Switch the AVD object model from Classic to ARM	The requesting user must be a Global Administrator in the Entra ID in order to grant the required admin consent.
Enable Sepago Azure monitoring	The requesting user must be an Owner on the selected resource group for deployment of the Log Analytics resources and permission assignment.
Create Azure Files shares	The requesting user must be a Contributor on the selected resource group for the storage account deployment. To join a newly created Azure Files share to Active Directory, the selected AD profile must have permissions to create ServicePrincipalName objects (See Permissions Required to Join Azure Files Share to Domain (Active Directory) for additional details.)
Create Azure NetApp Files volumes	The requesting user must be a Contributor on the selected resource group for NetApp account deployment and the vNet containing the NetApp Files subnet.
Create AVD ARM host pools	The requesting user must be a Contributor on the resource group in which the host pool is being created. To allow Nerdio Manager to manage app group membership, the requesting user must be an Owner on the resource group into which the host pool and app group are being deployed.
Add access to the Nerdio Manager for other users	The requesting user must be an AVD Admin in Nerdio Manager.
Associate session host VMs from previous AVD deployment	The requesting user must be a Contributor in the resource group that contains the VMs.

Ongoing Use Permissions

When the Nerdio Manager application is installed and configured, no user permissions in Azure are required to manage the configured AVD environment via Nerdio Manager. Most actions in Nerdio Manager run on Nerdio Manager on behalf of the signed in user.