You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Break glass access using Method D v2.0 is a streamlined approach for administrators to grant secure, emergency access to critical network fabric devices. This guide walks you through setting up and using break glass access, including generating SSH keys, granting permissions, and accessing network fabric devices.
15
15
16
-
Method D v2.0 also supports assigning roles to Entra Groups, streamlining the management of break glass access by leveraging group-based role assignments.
16
+
Method D v2.0 also supports assigning roles to Entra Groups, streamlining the management of break glass access by applying group-based role assignments.
17
17
18
18
## Generating SSH Keys using the Nexusidentity Azure CLI
19
19
@@ -83,7 +83,7 @@ To start with break glass Identity and Access Management (IAM) configuration, yo
83
83
az login
84
84
```
85
85
86
-
d. Run the following command to generate SSH keys:
86
+
d. To generate SSH keys run the following command:
87
87
88
88
```Azure CLI
89
89
az nexusidentity gen-keys
@@ -134,13 +134,14 @@ Once these roles are assigned, the corresponding username and public SSH key are
134
134
135
135
## Scope for group based role assignments
136
136
137
-
Role assignments can be made at either the subscription or fabric scope. But these role assignments have been validated at the fabric level. Each user must have rights for the specific fabric instance, which may be inherited from higher-level grants (e.g., subscription-level assignments).
137
+
Role assignments can be made at either the subscription or fabric scope. These role assignments were validated at the fabric level. Each user must have rights for the specific fabric instance, which may be inherited from higher-level grants (for example, subscription-level assignments).
138
138
139
-
Multiple groups can be assigned the same NNF built-in role (e.g., Nexus Network Fabric Service Reader or Writer) for a given fabric instance.
139
+
Multiple groups can be assigned the same Nexus Network Fabric (NNF) built-in role (for example, Nexus Network Fabric Service Reader or Writer) for a given fabric instance.
140
140
141
141
### User Limitations
142
-
A maximum of 200 user accounts (across all groups and individual assignments) can be granted BreakGlass access. This limit is subject to review in future releases.
143
-
Multiple groups may be assigned the same role for a fabric instance, but the 200-user limit still applies.
142
+
A maximum of 200 user accounts (across all groups and individual assignments) can be granted BreakGlass access.
143
+
144
+
Multiple groups may be assigned to the same role for a fabric instance, but the 200-user limit still applies.
144
145
145
146
> [!Note]
146
147
> Nested groups are not supported. Only direct group memberships are considered.
@@ -173,11 +174,11 @@ Upon assigning an Entra Group to a BreakGlass role, all users in that group will
173
174
174
175
BreakGlass account reconciliation occurs every four hours and ensures alignment between Entra role assignments and device access:
175
176
176
-
-**User Removed from Group**: Device access will be revoked.
177
+
-**User Removed from Group**: Device access is revoked.
177
178
178
-
-**User Added to Group**: Appropriate device access will be provisioned.
179
+
-**User Added to Group**: Appropriate device access is provisioned.
179
180
180
-
-**Group Role Assignment Removed**: All users in the group will have their access revoked.
181
+
-**Group Role Assignment Removed**: All users in the group have their access revoked.
181
182
182
-
-**Failure to Resolve Group Membership**: If group membership cannot be verified (e.g., due to Entra API failures or connectivity issues), no changes will be made to existing device accounts.
183
+
-**Failure to Resolve Group Membership**: If group membership cannot be verified (for example, due to Entra API failures or connectivity issues), no changes are made to existing device accounts.
0 commit comments