You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/azure-vmware/concepts-identity.md
+59-15Lines changed: 59 additions & 15 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,29 +2,27 @@
2
2
title: Concepts - Identity and access
3
3
description: Learn about the identity and access concepts of Azure VMware Solution
4
4
ms.topic: conceptual
5
-
ms.date: 07/29/2021
5
+
ms.date: 06/06/2022
6
6
---
7
7
8
8
# Azure VMware Solution identity concepts
9
9
10
-
Azure VMware Solution private clouds are provisioned with a vCenter Server and NSX-T Manager. You'll use vCenter to manage virtual machine (VM) workloads and NSX-T Manager to manage and extend the private cloud. The CloudAdmin role is used for vCenter Server and restricted administrator rights for NSX-T Manager.
10
+
Azure VMware Solution private clouds are provisioned with a vCenter Server and NSX-T Manager. You'll use vCenter to manage virtual machine (VM) workloads and NSX-T Manager to manage and extend the private cloud. The CloudAdmin role is used for vCenter Server and the administrator role (with restricted permissions) is used for NSX-T Manager.
> Azure VMware Solution offers custom roles on vCenter Server but currently doesn't offer them on the Azure VMware Solution portal. For more information, see the [Create custom roles on vCenter Server](#create-custom-roles-on-vcenter-server) section later in this article.
17
+
> Azure VMware Solution offers custom roles on vCenter Server but currently doesn't offer them on the Azure VMware Solution portal. For more information, see the [Create custom roles on vCenter Server](#create-custom-roles-on-vcenter-server) section later in this article.
18
18
19
19
### View the vCenter privileges
20
20
21
21
You can view the privileges granted to the Azure VMware Solution CloudAdmin role on your Azure VMware Solution private cloud vCenter.
22
22
23
-
1. Sign in to the vSphere Client and go to **Menu** > **Administration**.
24
-
23
+
1. Sign into the vSphere Client and go to **Menu** > **Administration**.
25
24
1. Under **Access Control**, select **Roles**.
26
-
27
-
1. From the list of roles, select **CloudAdmin** and then select **Privileges**.
25
+
1. From the list of roles, select **CloudAdmin** and then select **Privileges**.
28
26
29
27
:::image type="content" source="media/concepts/role-based-access-control-cloudadmin-privileges.png" alt-text="Screenshot showing the roles and privileges for CloudAdmin in the vSphere Client.":::
30
28
@@ -53,9 +51,9 @@ The CloudAdmin role in Azure VMware Solution has the following privileges on vCe
53
51
54
52
### Create custom roles on vCenter Server
55
53
56
-
Azure VMware Solution supports the use of custom roles with equal or lesser privileges than the CloudAdmin role.
54
+
Azure VMware Solution supports the use of custom roles with equal or lesser privileges than the CloudAdmin role.
57
55
58
-
You'll use the CloudAdmin role to create, modify, or delete custom roles with privileges lesser than or equal to their current role. You can create roles with privileges greater than CloudAdmin, but you can't assign the role to any users or groups or delete the role.
56
+
You'll use the CloudAdmin role to create, modify, or delete custom roles with privileges lesser than or equal to their current role. You can create roles with privileges greater than CloudAdmin. You can't assign the role to any users or groups or delete the role.
59
57
60
58
To prevent creating roles that can't be assigned or deleted, clone the CloudAdmin role as the basis for creating new custom roles.
61
59
@@ -66,14 +64,13 @@ To prevent creating roles that can't be assigned or deleted, clone the CloudAdmi
66
64
67
65
1. Select the **CloudAdmin** role and select the **Clone role action** icon.
68
66
69
-
>[!NOTE]
67
+
>[!NOTE]
70
68
>Don't clone the **Administrator** role because you can't use it. Also, the custom role created can't be deleted by cloudadmin\@vsphere.local.
71
69
72
70
1. Provide the name you want for the cloned role.
73
71
74
72
1. Add or remove privileges for the role and select **OK**. The cloned role is visible in the **Roles** list.
75
73
76
-
77
74
#### Apply a custom role
78
75
79
76
1. Navigate to the object that requires the added permission. For example, to apply permission to a folder, navigate to **Menu** > **VMs and Templates** > **Folder Name**.
@@ -90,12 +87,59 @@ To prevent creating roles that can't be assigned or deleted, clone the CloudAdmi
90
87
91
88
## NSX-T Manager access and identity
92
89
93
-
>[!NOTE]
94
-
>NSX-T [!INCLUDE [nsxt-version](includes/nsxt-version.md)] is currently supported for all new private clouds.
90
+
When a private cloud is provisioned using Azure portal, Software Defined Data Center (SDDC) management components like vCenter and NSX-T Manager are provisioned for customers.
91
+
92
+
Microsoft is responsible for the lifecycle management of NSX-T appliances like NSX-T Managers and NSX-T Edges. They're responsible for bootstrapping network configuration, like creating the Tier-0 gateway.
93
+
94
+
You're responsible for NSX-T software-defined networking (SDN) configuration, for example:
95
+
96
+
- Network segments
97
+
- Other Tier-1 gateways
98
+
- Distributed firewall rules
99
+
- Stateful services like gateway firewall
100
+
- Load balancer on Tier-1 gateways
101
+
102
+
You can access NSX-T Manager using the built-in local user "admin" assigned to **Enterprise admin** role that gives full privileges to a user to manage NSX-T. While Microsoft manages the lifecycle of NSX-T, certain operations aren't allowed by a user. Operations not allowed include editing the configuration of host and edge transport nodes or starting an upgrade. For new users, Azure VMware Solution deploys them with a specific set of permissions needed by that user. The purpose is to provide a clear separation of control between the Azure VMware Solution control plane configuration and Azure VMware Solution private cloud user.
103
+
104
+
For new private cloud deployments (in US West and Australia East) starting **June 2022**, NSX-T access will be provided with a built-in local user `cloudadmin` with a specific set of permissions to use only NSX-T functionality for workloads. The new **cloudadmin** user role will be rolled out in other regions in phases.
105
+
106
+
> [!NOTE]
107
+
> Admin access to NSX-T will not be provided to users for private cloud deployments created after **June 2022**.
108
+
109
+
### NSX-T cloud admin user permissions
110
+
111
+
The following permissions are assigned to the **cloudadmin** user in Azure VMware Solution NSX-T.
| Networking | IP Management | DNS<br>DHCP<br>IP Address Pools | Full Access<br>Full Access<br>Full Access |
118
+
| Networking | Profiles || Full Access |
119
+
| Security | East West Security | Distributed Firewall<br>Distributed IDS and IPS<br>Identity Firewall | Full Access<br>Full Access<br>Full Access |
120
+
| Security | North South Security | Gateway Firewall<br>URL Analysis | Full Access<br>Full Access |
121
+
| Security | Network Introspection || Read-only |
122
+
| Security | Endpoint Protection || Read-only |
123
+
| Security | Settings || Full Access |
124
+
| Inventory ||| Full Access |
125
+
| Troubleshooting | IPFIX || Full Access |
126
+
| Troubleshooting | Port Mirroring || Full Access |
127
+
| Troubleshooting | Traceflow || Full Access |
128
+
| System | Configuration<br>Settings<br>Settings<br>Settings | Identity firewall<br>Users and Roles<br>Certificate Management<br>User Interface Settings | Full Access<br>Full Access<br>Full Access<br>Full Access |
129
+
| System | All other || Read-only |
130
+
131
+
132
+
You can view the permissions granted to the Azure VMware Solution CloudAdmin role using the following steps:
133
+
134
+
1. Log in to the NSX-T Manager.
135
+
1. Navigate to **Systems** > **Users and Roles** and locate **User Role Assignment**.
136
+
1. The **Roles** column for the CloudAdmin user provides information on the NSX role-based access control (RBAC) roles assigned.
137
+
1. Select the the **Roles** tab to view specific permissions associated with each of the NSX RBAC roles.
138
+
1. To view **Permissions**, expand the **CloudAdmin** role and select a category like, Networking or Security.
95
139
96
-
Use the *admin* account to access NSX-T Manager. It has full privileges and lets you create and manage Tier-1 (T1) gateways, segments (logical switches), and all services. In addition, the privileges give you access to the NSX-T Tier-0 (T0) gateway. A change to the T0 gateway could result in degraded network performance or no private cloud access. Open a support request in the Azure portal to request any changes to your NSX-T T0 gateway.
140
+
> [!NOTE]
141
+
> The current Azure VMware Solution with **NSX-T admin user** will eventually switch from **admin** user to **cloudadmin** user. You'll receive a notification through Azure Service Health that includes the timeline of this change so you can change the NSX-T credentials you've used for the other integration.
97
142
98
-
99
143
## Next steps
100
144
101
145
Now that you've covered Azure VMware Solution access and identity concepts, you may want to learn about:
0 commit comments