Question 1

Getting started with NubOps

Accepted Answer

This tutorial focuses on the main steps on how to start using NubOps. These steps are: test

Sign up and log in to NubOps
Load the built-in Demo project in NubOps to see an example of how everything works
Retrieve data from your Azure subscription(s) either using:

An Entra ID work account or
An Entra ID App Registration

Signing up and logging in

There are two options for signing up. The first is to sign up using a Microsoft Work account. The second option is to use an email address. The work account option utilizes Microsoft's native authentication mechanism, which is the same as is used when authenticating to any Microsoft service, such as the Azure portal or Office 365. This means that if you're already logged in to a Microsoft service, then you'll be able to seamlessly log in to NubOps. Just select the Microsoft Work account that you want to log in with from the list that appears once you click on the “Sign up with Microsoft” button.

Sign up

The “NubOps Sign In” Enterprise Application has to be registered in your Entra ID to enable authentication using a Microsoft work account. This requires giving consent to this Enterprise Application to access your Entra ID. This may very well have to be done by someone who has administrator privileges in your Entra ID tenant.

There is a security-related setting for ‘Enterprise Applications’ in Entra ID called ‘User consent setti

Question 2

Is there any additional information about how I can use NubOps or how Azure works?

Accepted Answer

We provide videos on our YouTube channel for those who are new to working with Azure, but also on how to use the different features in NubOps. The purpose of these videos is, in part, to showcase the different features in NubOps but we also want to provide insights that will help you when starting to work with Azure or to improve governance and security controls in your Azure environment.

Here is the link to our channel: NubisOperandis

The videos are mainly focused around these topics:

Introduction to NubOps and tutorials for new users
Detailed walkthroughs on how to use specific features in NubOps
Information about reference architectures for different types of resources that can be deployed in Azure
Insights into best practices and Microsoft recommendations regarding governance and security controls in Azure

Question 3

Why does the verify connection operation fail for the connection with app registration?

Accepted Answer

Make sure you have entered the correct information for authenticating using an app registration, and that the app registration has the necessary permissions in Azure IAM (reader role assignment) on the subscription that you want to analyze.

Go to the app registration in Entra ID, find the following values and enter them in the "Edit Project" window:

Tenant Id: Copy the "Directory (tenant) ID" value from the app registration overview blade
Client Id: Copy the "Application (client) ID" value from the app registration overview blade
Client Secret: Copy the secret value from the app registration's certificates & secrets blade

Question 4

Which type of resources are included in the detailed architecture diagrams?

Accepted Answer

All resources, including hidden resources in Azure, are shown in the diagram that is based on the resource group viewpoint. However, resource types that aren't fully supported yet are shown as being of the default "Resource" type. This means that it isn't possible to see the detailed properties of that resource type yet. Full support for additional resource types are added based on community feedback.

NubOps currently supports graphically describing and providing detailed properties for the following resource types:

IaaS services

Virtual Machines
Virtual Machine Scale Sets
Virtual Machine Scale Set Virtual Machines
Availability Sets
Proximity Placement Groups
Capacity Reservation Groups
Dedicated Host Groups

PaaS services

Web Apps
Web App Plans
Web App Slots
Web App Configurations
Web App Slot Configurations
Autoscale Settings
App Service Environments
Function Apps
Logic Apps (standard)

Container services

Container Registries
Container Instances
Container Groups
Managed Clusters

Serverless services

Logic Apps (consumption)
Integration Accounts
Api Management Service
Event Hub Namespaces
Event Hubs
Notification Hub Namespaces
Notification Hubs

DBaaS services

Azure SQL Servers
Azure SQL Databases
Azure SQL Elastic Pools
MySQL Servers
MySQL Databases
Cosmos DB Accounts
Redis Caches
PostgreSQL Servers
PostgreSQL Databases
MariaDB Servers
MariaDB Databases

Network services *

Question 5

What is the recommendation on how to start using NubOps?

Accepted Answer

When you create an app registration you also have to assign a role to that app registration in Azure IAM on the subscriptions you want NubOps to analyze.

Our recommendation is to start out by only assigning the app registration the "Reader" role on one single non-production subscription in Azure. If possible, create a new Azure subscription where you can experiment without affecting other resources. This will also reduce initial "noise" in NubOps as you start out.

The Policies feature will generate a lot of findings and recommendations, so it makes sense to start out by creating a green field environment. Then you could create one resource type at a time, a virtual machine for example, to see what needs to be reconfigured based on the findings and recommendations provided by the Policies feature. This will give you insights into best practices concerning Azure security and governance. Once you've gained a good understanding of how to use NubOps, and identified potential improvements to the rest of your environment, you can use NubOps to verify that the tasks agreed upon within your organization have indeed been carried out and completed correctly, according to plan.

Question 6

How can I restrict which data NubOps retrieves from Azure?

Accepted Answer

When you create an app registration, you prevent NubOps from accessing data by only assigning the Reader role to the app registration on those subscriptions that you want to use NubOps with.

We recommend following the information security principle called "Least privilege" for all types of authorizations, meaning that you should only grant the privileges or permissions that are required for NubOps to perform the task that you want it to. When you create the app registration, select 'single tenant mode'. Also choose the "Application permissions" option since NubOps likely requires fewer permissions and privileges than your regular Microsoft work account has assigned to it. When using an app registration, NubOps does not use your user account credentials, which means that it is probable that you will see less in NubOps as compared to the Azure portal if you have adhered to the principle of "Least privileges".

Featured & Frequently Read Articles

Browse All Categories