Question 1

Getting started with NubOps

Accepted Answer

This tutorial focuses on the main steps on how to start using NubOps. These steps are: test

Sign up and log in to NubOps
Load the built-in Demo project in NubOps to see an example of how everything works
Retrieve data from your Azure subscription(s) either using:

An Entra ID work account or
An Entra ID App Registration

Signing up and logging in

There are two options for signing up. The first is to sign up using a Microsoft Work account. The second option is to use an email address. The work account option utilizes Microsoft's native authentication mechanism, which is the same as is used when authenticating to any Microsoft service, such as the Azure portal or Office 365. This means that if you're already logged in to a Microsoft service, then you'll be able to seamlessly log in to NubOps. Just select the Microsoft Work account that you want to log in with from the list that appears once you click on the “Sign up with Microsoft” button.

Sign up

The “NubOps Sign In” Enterprise Application has to be registered in your Entra ID to enable authentication using a Microsoft work account. This requires giving consent to this Enterprise Application to access your Entra ID. This may very well have to be done by someone who has administrator privileges in your Entra ID tenant.

There is a security-related setting for ‘Enterprise Applications’ in Entra ID called ‘User consent setti

Question 2

Is there any additional information about how I can use NubOps or how Azure works?

Accepted Answer

We provide videos on our YouTube channel for those who are new to working with Azure, but also on how to use the different features in NubOps. The purpose of these videos is, in part, to showcase the different features in NubOps but we also want to provide insights that will help you when starting to work with Azure or to improve governance and security controls in your Azure environment.

Here is the link to our channel: NubisOperandis

The videos are mainly focused around these topics:

Introduction to NubOps and tutorials for new users
Detailed walkthroughs on how to use specific features in NubOps
Information about reference architectures for different types of resources that can be deployed in Azure
Insights into best practices and Microsoft recommendations regarding governance and security controls in Azure

Question 3

Is there a way that I can group together all the different components in my solution in the same model?

Accepted Answer

There are two architecture viewpoints in NubOps which are customizable in the way that they are based on the 'tags' you have assigned to your resources in Azure, i.e, virtual machines, availability sets, web apps, databases, etc. These two viewpoints generate the 'Applications' and 'Application Tiers' entities in the Diagrams feature, and those are created based on the following tags:

'Application' or 'ApplicationId'
'ApplicationTier'
'Environment'

The two application viewpoints support these tiers:

Presentation
Application
Data
Storage
Security
Governance

There are multiple options for assigning values to the 'ApplicationTier' tag. These values are case-insensitive, meaning that NubOps supports all variations regarding upper and lower casing.

Supported 'Presentation tier' tag values

Frontend
FE
Web

Supported 'Application tier' tag values:

Backend
BE
App
Application
ApplicationServer
Middleware
Middle

Supported 'Data tier' tag values:

Data
DB
Database

Supported 'Storage tier' tag values:

Storage
Disk

Supported 'Governance tier' tag values:

Governance

Supported 'Security tier' tag values:

Security

You can use either the 'Application' or 'ApplicationId' tag as the primary name, which is what will appear in the left sidebar in the Diagrams feature. The 'ApplicationId' is usually a unique ID that is related to the use of a CMDB. If

Question 4

How does NubOps retrieve information about my Azure environment?

Accepted Answer

NubOps retrieves data by using either your Microsoft work account or an app registration that you create in your Entra ID tenant. If using an app registration, you also need to assign the "Reader" role to the app registration in Azure IAM on the subscription(s) that you want to work with in NubOps.

Using your Microsoft work account to log in to NubOps requires issuing admin consent to the "NubOps Sign In" Enterprise Application. Issuing consent will assign the following delegated Microsoft Graph API permissions to the "NubOps Sign In" to it:

NubOps Sign In permissions

Sign users in (claim value: openid)
View users' basic profile (claim value: profile)

Using your Microsoft work account to analyze data requires issuing admin consent to the "NubOps Azure Connector" Enterprise Application. This will assign the following delegated Microsoft Graph API permissions to it in your Entra ID tenant:

NubOps Azure Connector permissions

Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Maintain access to data you have given it access to (claim value: offline_access)

An App Registration needs the following role assigned to it in Azure IAM on the subscription(s) that you want to analyze:

Azure IAM permissions

Reader role assignment

When you create an app registration (select 'single tenant mode') you'll get three values: "tenant ID", "client ID" and "client secret". These three values are then entered into the "Edit project" wi

Question 5

Why does the verify connection operation fail for the connection with app registration?

Accepted Answer

Make sure you have entered the correct information for authenticating using an app registration, and that the app registration has the necessary permissions in Azure IAM (reader role assignment) on the subscription that you want to analyze.

Go to the app registration in Entra ID, find the following values and enter them in the "Edit Project" window:

Tenant Id: Copy the "Directory (tenant) ID" value from the app registration overview blade
Client Id: Copy the "Application (client) ID" value from the app registration overview blade
Client Secret: Copy the secret value from the app registration's certificates & secrets blade

Question 6

Which type of resources are included in the detailed architecture diagrams?

Accepted Answer

All resources, including hidden resources in Azure, are shown in the diagram that is based on the resource group viewpoint. However, resource types that aren't fully supported yet are shown as being of the default "Resource" type. This means that it isn't possible to see the detailed properties of that resource type yet. Full support for additional resource types are added based on community feedback.

NubOps currently supports graphically describing and providing detailed properties for the following resource types:

IaaS services

Virtual Machines
Virtual Machine Scale Sets
Virtual Machine Scale Set Virtual Machines
Availability Sets
Proximity Placement Groups
Capacity Reservation Groups
Dedicated Host Groups

PaaS services

Web Apps
Web App Plans
Web App Slots
Web App Configurations
Web App Slot Configurations
Autoscale Settings
App Service Environments
Function Apps
Logic Apps (standard)

Container services

Container Registries
Container Instances
Container Groups
Managed Clusters

Serverless services

Logic Apps (consumption)
Integration Accounts
Api Management Service
Event Hub Namespaces
Event Hubs
Notification Hub Namespaces
Notification Hubs

DBaaS services

Azure SQL Servers
Azure SQL Databases
Azure SQL Elastic Pools
MySQL Servers
MySQL Databases
Cosmos DB Accounts
Redis Caches
PostgreSQL Servers
PostgreSQL Databases
MariaDB Servers
MariaDB Databases

Network services *

Featured & Frequently Read Articles

Browse All Categories