Azure Networking and Identity Integration for Nutanix Workloads
Domain 2: Azure networking and identity integration for Nutanix workloads
This domain tests connectivity between NC2, Azure VNets, and on-premises identity, plus correct separation of Azure and Nutanix control planes.
Network integration
- NC2 cluster nodes sit in an Azure VNet subnet. Guest VMs on AHV use that subnet's routing for north-south traffic; east-west guest traffic stays inside the cluster unless routed out.
- Use hub-and-spoke with Azure Firewall/NVA and UDRs for inspection. VNet peering is non-transitive: spoke-to-spoke traffic needs a hub route or gateway transit.
- Private DNS and custom DNS forwarders matter: Prism Central and guest VMs must resolve AD domain controllers and each other. Overlapping on-prem/Azure CIDRs break VPN/ExpressRoute designs.
Identity integration
- Prism Central joins AD/LDAP for user and group authentication and assigns RBAC roles (e.g., Prism Admin, VM Admin, Viewer). Azure RBAC governs Azure resources, not Prism actions.
- For SSO, configure Prism Central as a SAML service provider with Entra ID (Azure AD) as IdP; map Entra groups to Prism roles. Directory synchronization still matters for group-based authorization.
- The NC2 deployment uses an Entra service principal/app registration with subscription-level permissions; this is separate from user SSO.
Worked example
On-prem users need Prism Central SSO. Deploy PC in Azure, join it to the AD domain over ExpressRoute, configure DNS forwarders, create an Entra Enterprise App for SAML, assign an Entra group, and map that group to a Prism Viewer role. Azure RBAC Reader on the resource group does not let them manage VMs.
Traps
Assuming peering transitivity; forgetting DNS; granting subscription Owner to the NC2 service principal when a scoped custom role suffices; expecting Entra ID groups to appear in Prism without AD/LDAP sync.