Azure accounts and permissions
Suggest changes
PDFs
Cloud Manager enables you to choose the Azure account in which you want to deploy a Cloud Volumes ONTAP system. You can deploy all of your Cloud Volumes ONTAP systems in the initial Azure account, or you can set up additional accounts.
The initial Azure account
When you deploy Cloud Manager from NetApp Cloud Central, you need to use an Azure account that has permissions to deploy the Cloud Manager virtual machine. The required permissions are listed in the NetApp Cloud Central policy for Azure.
When Cloud Central deploys the Cloud Manager virtual machine in Azure, it enables a system-assigned managed identity on the Cloud Manager virtual machine, creates a custom role, and assigns it to the virtual machine. The role provides Cloud Manager with permissions to deploy and manage Cloud Volumes ONTAP in that Azure subscription. Review how Cloud Manager uses the permissions.
Cloud Manager selects this cloud provider account by default when you create a new working environment:
Additional Azure subscriptions for the initial account
The managed identity is associated with the subscription in which you launched Cloud Manager. If you want to select a different Azure subscription, then you need to associate the managed identity with those subscriptions.
Additional Azure accounts
If you want to deploy Cloud Volumes ONTAP in different Azure accounts, then you must grant the required permissions by creating and setting up a service principal in Azure Active Directory for each Azure account. The following image shows two additional accounts, each set up with a service principal and custom role that provides permissions:
You would then add the cloud provider accounts to Cloud Manager by providing details about the AD service principal.
After you add another account, you can switch to it when creating a new working environment:
