Nerdio Compass Permissions and Access Reference

No. Signing in and completing setup requires only a work or school account - no administrator role of any kind, and no elevated privilege. You don't need to be a Global Administrator, and nothing is granted to Compass in your tenant at this stage. Administrator privilege only becomes relevant once you decide to connect a platform to Compass, which is always a separate, deliberate step you take later, after you've already seen the product. 

You sign in with your own work or school account (Compass never sees your password, since authentication is delegated to your own identity provider), choose the region your workspace's data will live in, tell us a little about yourself and your organization, and accept the terms of service. Compass then creates a workspace private to your organization. At this point the workspace is empty - nothing has been read from your environment, because nothing has been connected yet. 

If your organization restricts user consent, your first sign-in will pause and ask for administrator approval instead of continuing. A Global Administrator (or Privileged Role Administrator, or Cloud Application Administrator) approves the Compass sign-in application once, for the whole tenant - after that, everyone else signs in normally. This approval covers sign-in only: reading your name and email so Compass knows who you are. It grants no access to your directory, devices, subscriptions, or data - those are separate grants that only happen if you choose to connect a platform. 

Just a work or school account - nothing else. An invited colleague's first sign-in is condensed to brief context about the product, followed by whatever they were invited into. 

No - Compass has no roles inside a workspace. Anyone who's a member can do everything the workspace can do: import snapshots, connect platforms, add subscriptions, export reports, and change report branding. Invite people on the same basis you'd grant them the underlying access, since membership is the only boundary inside a workspace. Workspaces themselves are strictly isolated from one another - your organization can never see another organization's data. 

No. Every platform Compass supports can be assessed without granting Compass any access to your environment, by running an export tool yourself and uploading the file it produces. That upload path requires no consent, no service principal, no API client, and no inbound network access from Compass to you - there's nothing for a security team to approve except the file leaving your building. 

Connecting a platform directly is entirely optional, and it's always a decision you make after you've already seen the product - you're never asked for it during first-run setup. 

A snapshot is the point-in-time capture of your environment's configuration that Compass actually assesses - it's the same underlying data whether it was produced by an export tool you ran yourself or captured through a direct connection. A connection is the read-only link Compass uses to reach into your environment. Having a connection doesn't create a snapshot by itself - it just lets you capture and import one directly from within Compass, without needing to run a separate tool and upload the result. 

The following table shows what a direct connection is available for today, and who in your organization needs to approve it. Other supported platforms - including Citrix Virtual Apps and Desktops (CVAD) - are assessed via snapshot upload only, at least for now. 

No. You can capture a snapshot of your Citrix environment with the Citrix Export tool and import it into Compass without granting Compass any access to your Citrix environment at all. This is the only option for Citrix Virtual Apps and Desktops (CVAD) environments today, and it remains a fully supported option for Citrix DaaS environments too, for organizations that would rather not open a direct connection from Compass to their production environment. 

A direct connection doesn't change what Compass can see - it changes how conveniently you can capture and import a snapshot. Instead of running the Citrix Export tool yourself and then uploading the file it produces, you can select Import snapshot directly in Compass, choose your Citrix DaaS connection, and Compass creates and imports the snapshot for you in one step. From the Connections page, you can also trigger a new snapshot from an existing connection at any time, without stepping back through the full import flow, and manage the connection itself (retest it, check its status) in the same place. 

In short: a direct connection is never required, but if you have one, it removes the manual export-and-upload step from the process. 

No. A direct connection is currently available for Citrix DaaS (Citrix Cloud) environments only. If you have a Citrix Virtual Apps and Desktops (CVAD) environment, capture snapshots with the Citrix Export tool and import them into Compass - support for connecting directly to a CVAD environment may be added in a future release. 

A Citrix Cloud administrator creates a read-only API client (technically a service principal) scoped to the Read Only Administrator role for DaaS. Compass authenticates with a customer ID, a client ID, and a client secret; the secret is held in a dedicated secret store, never in the application database, and is used only to obtain short-lived tokens. With this access, Compass reads delivery groups, machine catalogs, applications, policies, and session data - it never writes anything to your Citrix environment. 

For the full setup steps, see Connect a Citrix DaaS Environment to Nerdio Compass. 

Because Entra, Intune, and Windows 365 are managed through Microsoft Graph, while Azure Virtual Desktop is managed through Azure Resource Manager - a different system with no Graph permissions at all. Consenting to Graph permissions doesn't grant anything in Azure, and adding an Azure subscription doesn't grant anything in Graph - they're genuinely separate systems, not two steps of one process. Most organizations that use both end up completing both grants. 

A Global Administrator opens the consent link Compass provides and approves it once for the tenant. This also creates the Compass service principal in your directory, which is why the role is required even though every permission requested is read-only: 

Compass doesn't request Exchange Online or SharePoint Online permissions - some tenants don't have a service principal for those services, and including them would cause the entire consent request to fail rather than just skipping the unavailable part. 

Adding a subscription is a separate grant from Microsoft Graph consent. Whoever adds it needs Owner or User Access Administrator on that specific subscription, because the action writes a role assignment - Global Administrator doesn't confer this by default. The grant itself is Reader on the subscription, the simplest built-in role available. With it, Compass reads how your virtual desktops are configured - never what's inside them. 

No. Every permission described in this reference is a read permission - there's no grant anywhere that lets Compass create, modify, or delete a resource in your environment. Compass assesses an estate; it doesn't change one. 

No. Compass never requires a network route from us into your environment. Snapshot collection via an export tool runs entirely inside your own environment, and even a direct Citrix DaaS or Microsoft connection only ever reaches out from Compass using the credentials you've granted - nothing reaches in. 

Yes. A workspace is strictly isolated from every other workspace - one organization can never see another's data, and a grant made in your tenant is only ever usable for your tenant. 

Authentication to your identity provider is always delegated - Compass never sees or stores your password. Where Compass does hold a credential, such as a Citrix API client secret, it's kept in a dedicated secret store rather than the application database, and used only to obtain short-lived tokens. Compass also never asks for mailbox, file, or message content - only configuration. 

Your organization restricts user consent to new applications. Ask a Global Administrator to approve the Compass sign-in application once - after that, everyone else can sign in normally. 

Yes. A new workspace holds nothing until you connect a platform or upload a snapshot - nothing is read from your environment automatically. 

No - the region is fixed when your workspace is created. Contact support before adding any data rather than working around it. 

You can likely see the subscription but can't write a role assignment on it. You'll need Owner or User Access Administrator on that specific subscription - Contributor isn't enough, and Global Administrator doesn't grant it by default. 

Microsoft Graph consent and the Azure subscription role are separate grants. Graph consent covers Entra, Intune, and Windows 365; Azure Virtual Desktop needs the subscription role assignment as well. 

Compass lists the subscriptions the signed-in administrator can see. If one is missing, that account doesn't have access to it - sign in as an administrator who does. 

Confirm they're using a work or school account from your organization, and that the sign-in application has been approved if your organization restricts user consent.