Skip to content

Commit 49e4ed9

Browse files
committed
Update howto-use-break-glass-access.md
1 parent cb23601 commit 49e4ed9

File tree

1 file changed

+11
-10
lines changed

1 file changed

+11
-10
lines changed

articles/operator-nexus/howto-use-break-glass-access.md

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ms.custom: template-how-to, devx-track-azurecli
1313

1414
Break glass access using Method D v2.0 is a streamlined approach for administrators to grant secure, emergency access to critical network fabric devices. This guide walks you through setting up and using break glass access, including generating SSH keys, granting permissions, and accessing network fabric devices.
1515

16-
Method D v2.0 also supports assigning roles to Entra Groups, streamlining the management of break glass access by leveraging group-based role assignments.
16+
Method D v2.0 also supports assigning roles to Entra Groups, streamlining the management of break glass access by applying group-based role assignments.
1717

1818
## Generating SSH Keys using the Nexusidentity Azure CLI
1919

@@ -83,7 +83,7 @@ To start with break glass Identity and Access Management (IAM) configuration, yo
8383
az login
8484
```
8585
86-
d. Run the following command to generate SSH keys:
86+
d. To generate SSH keys run the following command:
8787
8888
```Azure CLI
8989
az nexusidentity gen-keys
@@ -134,13 +134,14 @@ Once these roles are assigned, the corresponding username and public SSH key are
134134
135135
## Scope for group based role assignments
136136
137-
Role assignments can be made at either the subscription or fabric scope. But these role assignments have been validated at the fabric level. Each user must have rights for the specific fabric instance, which may be inherited from higher-level grants (e.g., subscription-level assignments).
137+
Role assignments can be made at either the subscription or fabric scope. These role assignments were validated at the fabric level. Each user must have rights for the specific fabric instance, which may be inherited from higher-level grants (for example, subscription-level assignments).
138138
139-
Multiple groups can be assigned the same NNF built-in role (e.g., Nexus Network Fabric Service Reader or Writer) for a given fabric instance.
139+
Multiple groups can be assigned the same Nexus Network Fabric (NNF) built-in role (for example, Nexus Network Fabric Service Reader or Writer) for a given fabric instance.
140140
141141
### User Limitations
142-
A maximum of 200 user accounts (across all groups and individual assignments) can be granted BreakGlass access. This limit is subject to review in future releases.
143-
Multiple groups may be assigned the same role for a fabric instance, but the 200-user limit still applies.
142+
A maximum of 200 user accounts (across all groups and individual assignments) can be granted BreakGlass access.
143+
144+
Multiple groups may be assigned to the same role for a fabric instance, but the 200-user limit still applies.
144145
145146
> [!Note]
146147
> Nested groups are not supported. Only direct group memberships are considered.
@@ -173,11 +174,11 @@ Upon assigning an Entra Group to a BreakGlass role, all users in that group will
173174

174175
BreakGlass account reconciliation occurs every four hours and ensures alignment between Entra role assignments and device access:
175176

176-
- **User Removed from Group**: Device access will be revoked.
177+
- **User Removed from Group**: Device access is revoked.
177178

178-
- **User Added to Group**: Appropriate device access will be provisioned.
179+
- **User Added to Group**: Appropriate device access is provisioned.
179180

180-
- **Group Role Assignment Removed**: All users in the group will have their access revoked.
181+
- **Group Role Assignment Removed**: All users in the group have their access revoked.
181182

182-
- **Failure to Resolve Group Membership**: If group membership cannot be verified (e.g., due to Entra API failures or connectivity issues), no changes will be made to existing device accounts.
183+
- **Failure to Resolve Group Membership**: If group membership cannot be verified (for example, due to Entra API failures or connectivity issues), no changes are made to existing device accounts.
183184

0 commit comments

Comments
 (0)