Question 1

Getting started with NubOps

Accepted Answer

This tutorial focuses on the main steps on how to start using NubOps. These steps are: test

Sign up and log in to NubOps
Load the built-in Demo project in NubOps to see an example of how everything works
Retrieve data from your Azure subscription(s) either using:

An Entra ID work account or
An Entra ID App Registration

Signing up and logging in

There are two options for signing up. The first is to sign up using a Microsoft Work account. The second option is to use an email address. The work account option utilizes Microsoft's native authentication mechanism, which is the same as is used when authenticating to any Microsoft service, such as the Azure portal or Office 365. This means that if you're already logged in to a Microsoft service, then you'll be able to seamlessly log in to NubOps. Just select the Microsoft Work account that you want to log in with from the list that appears once you click on the “Sign up with Microsoft” button.

Sign up

The “NubOps Sign In” Enterprise Application has to be registered in your Entra ID to enable authentication using a Microsoft work account. This requires giving consent to this Enterprise Application to access your Entra ID. This may very well have to be done by someone who has administrator privileges in your Entra ID tenant.

There is a security-related setting for ‘Enterprise Applications’ in Entra ID called ‘User consent setti

Question 2

How does NubOps retrieve information about my Azure environment?

Accepted Answer

NubOps retrieves data by using either your Microsoft work account or an app registration that you create in your Entra ID tenant. If using an app registration, you also need to assign the "Reader" role to the app registration in Azure IAM on the subscription(s) that you want to work with in NubOps.

Using your Microsoft work account to log in to NubOps requires issuing admin consent to the "NubOps Sign In" Enterprise Application. Issuing consent will assign the following delegated Microsoft Graph API permissions to the "NubOps Sign In" to it:

NubOps Sign In permissions

Sign users in (claim value: openid)
View users' basic profile (claim value: profile)

Using your Microsoft work account to analyze data requires issuing admin consent to the "NubOps Azure Connector" Enterprise Application. This will assign the following delegated Microsoft Graph API permissions to it in your Entra ID tenant:

NubOps Azure Connector permissions

Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Maintain access to data you have given it access to (claim value: offline_access)

An App Registration needs the following role assigned to it in Azure IAM on the subscription(s) that you want to analyze:

Azure IAM permissions

Reader role assignment

When you create an app registration (select 'single tenant mode') you'll get three values: "tenant ID", "client ID" and "client secret". These three values are then entered into the "Edit project" wi

Question 3

What is the recommendation on how to start using NubOps?

Accepted Answer

When you create an app registration you also have to assign a role to that app registration in Azure IAM on the subscriptions you want NubOps to analyze.

Our recommendation is to start out by only assigning the app registration the "Reader" role on one single non-production subscription in Azure. If possible, create a new Azure subscription where you can experiment without affecting other resources. This will also reduce initial "noise" in NubOps as you start out.

The Policies feature will generate a lot of findings and recommendations, so it makes sense to start out by creating a green field environment. Then you could create one resource type at a time, a virtual machine for example, to see what needs to be reconfigured based on the findings and recommendations provided by the Policies feature. This will give you insights into best practices concerning Azure security and governance. Once you've gained a good understanding of how to use NubOps, and identified potential improvements to the rest of your environment, you can use NubOps to verify that the tasks agreed upon within your organization have indeed been carried out and completed correctly, according to plan.

Question 4

Is there a way that I can group together all the different components in my solution in the same model?

Accepted Answer

There are two architecture viewpoints in NubOps which are customizable in the way that they are based on the 'tags' you have assigned to your resources in Azure, i.e, virtual machines, availability sets, web apps, databases, etc. These two viewpoints generate the 'Applications' and 'Application Tiers' entities in the Diagrams feature, and those are created based on the following tags:

'Application' or 'ApplicationId'
'ApplicationTier'
'Environment'

The two application viewpoints support these tiers:

Presentation
Application
Data
Storage
Security
Governance

There are multiple options for assigning values to the 'ApplicationTier' tag. These values are case-insensitive, meaning that NubOps supports all variations regarding upper and lower casing.

Supported 'Presentation tier' tag values

Frontend
FE
Web

Supported 'Application tier' tag values:

Backend
BE
App
Application
ApplicationServer
Middleware
Middle

Supported 'Data tier' tag values:

Data
DB
Database

Supported 'Storage tier' tag values:

Storage
Disk

Supported 'Governance tier' tag values:

Governance

Supported 'Security tier' tag values:

Security

You can use either the 'Application' or 'ApplicationId' tag as the primary name, which is what will appear in the left sidebar in the Diagrams feature. The 'ApplicationId' is usually a unique ID that is related to the use of a CMDB. If

Question 5

Why does the verify connection operation fail for the connection with app registration?

Accepted Answer

Make sure you have entered the correct information for authenticating using an app registration, and that the app registration has the necessary permissions in Azure IAM (reader role assignment) on the subscription that you want to analyze.

Go to the app registration in Entra ID, find the following values and enter them in the "Edit Project" window:

Tenant Id: Copy the "Directory (tenant) ID" value from the app registration overview blade
Client Id: Copy the "Application (client) ID" value from the app registration overview blade
Client Secret: Copy the secret value from the app registration's certificates & secrets blade

Question 6

How can I restrict which data NubOps retrieves from Azure?

Accepted Answer

When you create an app registration, you prevent NubOps from accessing data by only assigning the Reader role to the app registration on those subscriptions that you want to use NubOps with.

We recommend following the information security principle called "Least privilege" for all types of authorizations, meaning that you should only grant the privileges or permissions that are required for NubOps to perform the task that you want it to. When you create the app registration, select 'single tenant mode'. Also choose the "Application permissions" option since NubOps likely requires fewer permissions and privileges than your regular Microsoft work account has assigned to it. When using an app registration, NubOps does not use your user account credentials, which means that it is probable that you will see less in NubOps as compared to the Azure portal if you have adhered to the principle of "Least privileges".

Featured & Frequently Read Articles

Browse All Categories