How does NubOps retrieve information about my Azure environment?
NubOps retrieves data by using either your Microsoft work account or an app registration that you create in your Entra ID tenant. If using an app registration, you also need to assign the "Reader" role to the app registration in Azure IAM on the subscription(s) that you want to work with in NubOps.
Using your Microsoft work account to log in to NubOps requires issuing admin consent to the "NubOps Sign In" Enterprise Application. Issuing consent will assign the following delegated Microsoft Graph API permissions to the "NubOps Sign In" to it:
NubOps Sign In permissions
Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Using your Microsoft work account to analyze data requires issuing admin consent to the "NubOps Azure Connector" Enterprise Application. This will assign the following delegated Microsoft Graph API permissions to it in your Entra ID tenant:
NubOps Azure Connector permissions
Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Maintain access to data you have given it access to (claim value: offline_access)
An App Registration needs the following role assigned to it in Azure IAM on the subscription(s) that you want to analyze:
Azure IAM permissions
Reader role assignment
When you create an app registration (select 'single tenant mode') you'll get three values: "tenant ID", "client ID" and "client secret". These three values are then entered into the "Edit project" window in NubOps so that you can verify that the connection works.
If everything works fine, you'll be able to see your tenant and subscriptions in the Diagrams feature once you have verified the connection.
Microsoft provides this guide on this topic: Use the portal to create an Entra ID application and service principal that can access resources
You can also check out this video on how to create an App Registration: Getting started
Using your Microsoft work account to log in to NubOps requires issuing admin consent to the "NubOps Sign In" Enterprise Application. Issuing consent will assign the following delegated Microsoft Graph API permissions to the "NubOps Sign In" to it:
NubOps Sign In permissions
Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Using your Microsoft work account to analyze data requires issuing admin consent to the "NubOps Azure Connector" Enterprise Application. This will assign the following delegated Microsoft Graph API permissions to it in your Entra ID tenant:
NubOps Azure Connector permissions
Sign users in (claim value: openid)
View users' basic profile (claim value: profile)
Maintain access to data you have given it access to (claim value: offline_access)
An App Registration needs the following role assigned to it in Azure IAM on the subscription(s) that you want to analyze:
Azure IAM permissions
Reader role assignment
When you create an app registration (select 'single tenant mode') you'll get three values: "tenant ID", "client ID" and "client secret". These three values are then entered into the "Edit project" window in NubOps so that you can verify that the connection works.
If everything works fine, you'll be able to see your tenant and subscriptions in the Diagrams feature once you have verified the connection.
Microsoft provides this guide on this topic: Use the portal to create an Entra ID application and service principal that can access resources
You can also check out this video on how to create an App Registration: Getting started
Updated on: 04/03/2025
Thank you!