You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
1. Complete [prerequisites for your environment](../deploy/deployment-prerequisites.md).
30
+
- Download the [Configurator App for Azure Local](https://aka.ms/ConfiguratorAppForHCI).
31
31
32
-
1.[Prepare Active Directory](../deploy/deployment-prep-active-directory.md).
33
-
34
-
1.[Download the English-language Preview ISO](https://aka.ms/HCIReleaseImage).
35
-
36
-
1. Use the downloaded Preview ISO and follow the steps for operating system installation in [Install Azure Stack HCI Operating System, version 23H2](../deploy/deployment-install-os.md).
37
-
38
-
1. Download the [Configurator App for Azure Local](https://aka.ms/ConfiguratorAppForHCI).
39
-
40
-
1. Note down:
32
+
- Note down:
41
33
42
34
- The serial number for each machine.
43
35
- Local administrator credentials to sign into each machine.
44
36
45
37
### Azure prerequisites
46
38
47
-
1.**Register required resource providers.** Make sure that your Azure subscription is registered against the required resource providers. To register, you must be an owner or contributor on your subscription. You can also ask an administrator to register.
48
-
49
-
Run the following [PowerShell commands](/azure/azure-resource-manager/management/resource-providers-and-types#azure-powershell) to register:
1.**Create a resource group**. Follow the steps to [Create a resource group](/azure/azure-resource-manager/management/manage-resource-groups-portal#create-resource-groups) where you want to register your machines. Make a note of the resource group name and the associated subscription ID.
64
-
65
-
1.**Get the tenant ID**. Follow the steps in [Get the tenant ID of your Microsoft Entra tenant through the Azure portal](/azure/azure-portal/get-subscription-tenant-id):
66
-
67
-
1. In the Azure portal, go to **Microsoft Entra ID** > **Properties**.
1. Scroll down to the Tenant ID section and copy the **Tenant ID** value to use later.
70
-
71
-
1.**Get Arc gateway ID**. Skip this step if you didn't set up Azure Arc gateway. If you [Set up an Azure Arc gateway](../deploy/deployment-azure-arc-gateway-overview.md#create-the-arc-gateway-resource-in-azure), get the resource ID of the Arc gateway. This is also referred to as the `ArcGatewayID`.
41
+
-**Get Arc gateway ID**. Skip this step if you didn't set up Azure Arc gateway. If you [Set up an Azure Arc gateway](../deploy/deployment-azure-arc-gateway-overview.md#create-the-arc-gateway-resource-in-azure), get the resource ID of the Arc gateway. This is also referred to as the `ArcGatewayID`.
72
42
73
43
1. To get the `ArcGatewayID`, run the following command:
74
44
@@ -77,22 +47,7 @@ Before you begin, make sure that you complete the following prerequisites:
77
47
```
78
48
79
49
1. Make a note of the Arc gateway ID to use later.
80
-
81
-
1. **Verify permissions**. As you register machines as Arc resources, make sure that you're either the resource group owner or have the following permissions on the resource group where the machines are provisioned:
To verify that you have these roles, follow these steps in the Azure portal:
87
-
88
-
1. Go to the subscription you used for the Azure Local deployment.
89
-
90
-
1. Go to the resource group where you plan to register the machine.
91
-
92
-
1. In the left-pane, go to **Access Control (IAM)**.
93
-
94
-
1. In the right-pane, go to **Role assignments**. Verify that you have `Azure Connected Machine Onboarding` and `Azure Connected Machine Resource Administrator` roles assigned.
95
-
50
+
96
51
## Step 1: Configure the network and connect to Azure
97
52
98
53
Follow these steps to configure network settings and connect the machines to Azure. Start this action a few minutes after you turn on the machine.
@@ -138,7 +93,7 @@ Follow these steps to configure network settings and connect the machines to Azu
138
93
139
94
:::image type="content" source="media/deployment-arc-register-configurator-app/basics-tab-additional-details-1.png" alt-text="Screenshot of the Basics tab with additional details configured in the Configurator app for Azure Local." lightbox="media/deployment-arc-register-configurator-app/basics-tab-additional-details-1.png":::
140
95
141
-
1. Select **Off** to enable **Remote desktop** protocol.
96
+
1. Select **ON** to enable **Remote desktop** protocol. Remote desktop protocol is disabled by default.
142
97
143
98
1. Select **Public endpoint** or **Proxy server** as the connectivity method. If selecting a proxy server, provide the proxy URL and the bypass list.
144
99
@@ -180,7 +135,7 @@ Follow these steps to configure network settings and connect the machines to Azu
180
135
181
136
### Step 2: Complete registration of machines to Azure
182
137
183
-
1. Wait for the configuration to complete. First, machine details are uploaded followed by registration of the machines to Azure.
138
+
1. Wait for the configuration to complete. First, machine is configured with the basic details followed by registration of the machines to Azure.
184
139
185
140
1. During the Arc registration process, you must authenticate with your Azure account. The app displays a code that you must enter in the URL, displayed in the app, in order to authenticate. Follow the instructions to complete the authentication process.
Copy file name to clipboardExpand all lines: azure-local/deploy/deployment-arc-register-server-permissions.md
+16-57Lines changed: 16 additions & 57 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Register your Azure Local machines with Azure Arc and assign permissions
3
3
description: Learn how to Register your Azure Local machines with Azure Arc and assign permissions for deployment.
4
4
author: alkohli
5
5
ms.topic: how-to
6
-
ms.date: 03/11/2025
6
+
ms.date: 03/20/2025
7
7
ms.author: alkohli
8
8
ms.service: azure-local
9
9
ms.custom: devx-track-azurepowershell
@@ -19,42 +19,13 @@ This article describes how to register your Azure Local machines and then set up
19
19
20
20
Before you begin, make sure you've completed the following prerequisites:
21
21
22
-
- Satisfy the [prerequisites and complete deployment checklist](./deployment-prerequisites.md).
23
-
- Prepare your [Active Directory](./deployment-prep-active-directory.md) environment.
24
-
-[Install the Azure Stack HCI operating system, version 23H2](./deployment-install-os.md) on each machine.
25
-
26
-
- Register your subscription with the required resource providers (RPs). You can use either the [Azure portal](/azure/azure-resource-manager/management/resource-providers-and-types#register-resource-provider-1) or the [Azure PowerShell](/azure/azure-resource-manager/management/resource-providers-and-types#azure-powershell) to register. You need to be an owner or contributor on your subscription to register the following resource RPs:
27
-
-*Microsoft.HybridCompute*
28
-
-*Microsoft.GuestConfiguration*
29
-
-*Microsoft.HybridConnectivity*
30
-
-*Microsoft.AzureStackHCI*
31
-
-*Microsoft.Kubernetes*
32
-
-*Microsoft.KubernetesConfiguration*
33
-
-*Microsoft.ExtendedLocation*
34
-
-*Microsoft.ResourceConnector*
35
-
-*HybridContainerService*
36
-
37
-
> [!NOTE]
38
-
> The assumption is that the person registering the Azure subscription with the resource providers is a different person than the one who is registering the Azure Local machines with Arc.
39
-
40
-
- If you're registering the machines as Arc resources, make sure that you have the following permissions on the resource group where the machines were provisioned:
41
-
42
-
- Azure Connected Machine Onboarding
43
-
- Azure Connected Machine Resource Administrator
44
-
45
-
To verify that you have these roles, follow these steps in the Azure portal:
22
+
### Azure Local machine prerequisites
46
23
47
-
1. Go to the subscription that you use for the Azure Local deployment.
48
-
1. Go to the resource group where you're planning to register the machines.
49
-
1. In the left-pane, go to **Access Control (IAM)**.
50
-
1. In the right-pane, go the **Role assignments**. Verify that you have the **Azure Connected Machine Onboarding** and **Azure Connected Machine Resource Administrator** roles assigned.
<!--:::image type="content" source="media/deployment-arc-register-server-permissions/contributor-user-access-administrator-permissions.png" alt-text="Screenshot of the roles and permissions assigned in the deployment subscription." lightbox="./media/deployment-arc-register-server-permissions/contributor-user-access-administrator-permissions.png":::-->
26
+
### Azure prerequisites
53
27
54
-
- Check your Azure policies. Make sure that:
55
-
- The Azure policies aren't blocking the installation of extensions.
56
-
- The Azure policies aren't blocking the creation of certain resource types in a resource group.
57
-
- The Azure policies aren't blocking the resource deployment in certain locations.
Successfully triggered Arc boostrap support log collection. Waiting for 600 seconds to complete.
179
-
Waiting for Arc bootstrap support logs to complete on '', retry count: 0.
180
-
Arc bootstrap support log collection status is InProgress. Sleep for 10 seconds.
181
-
Waiting for Arc bootstrap support logs to complete on '', retry count: 1.
182
-
Arc bootstrap support log collection status is InProgress. Sleep for 10 seconds.
183
-
Waiting for Arc bootstrap support logs to complete on '', retry count: 2.
184
-
Arc boostrap support log collection completed successfully.
149
+
185
150
186
151
PS C:\Users\Administrator>
187
152
```
@@ -194,15 +159,12 @@ Before you begin, make sure you've completed the following prerequisites:
194
159
195
160
:::image type="content" source="media/deployment-arc-register-server-permissions/arc-servers-registered-1.png" alt-text="Screenshot of the Azure Local machines in the resource group after the successful registration." lightbox="./media/deployment-arc-register-server-permissions/arc-servers-registered-1.png":::
196
161
197
-
<!--1. The mandatory Azure Local extensions are installed on your machines. From the resource group, select the registered machine. Go to the **Extensions**. The mandatory extensions show up in the right pane.
198
162
199
-
:::image type="content" source="media/deployment-arc-register-server-permissions/mandatory-extensions-installed-registered-servers.png" alt-text="Screenshot of the Azure Local registered machines with mandatory extensions installed." lightbox="./media/deployment-arc-register-server-permissions/mandatory-extensions-installed-registered-servers.png"::: -->
200
163
201
164
> [!NOTE]
202
165
> Once an Azure Local machine is registered with Azure Arc, the only way to undo the registration is to install the operating system again on the machine.
203
166
204
167
205
-
206
168
## Assign required permissions for deployment
207
169
208
170
This section describes how to assign Azure permissions for deployment from the Azure portal.
@@ -227,12 +189,9 @@ This section describes how to assign Azure permissions for deployment from the A
227
189
- **Key Vault Contributor**: This permission is required to create the key vault used for deployment.
228
190
- **Storage Account Contributor**: This permission is required to create the storage account used for deployment.
229
191
230
-
<!--:::image type="content" source="media/deployment-arc-register-server-permissions/add-role-assignment-3.png" alt-text="Screenshot of the review + Create tab in Add role assignment for Azure Local deployment." lightbox="./media/deployment-arc-register-server-permissions/add-role-assignment-3.png":::-->
231
192
232
193
1. In the right pane, go to **Role assignments**. Verify that the deployment user has all the configured roles.
233
194
234
-
<!--:::image type="content" source="media/deployment-arc-register-server-permissions/add-role-assignment-4.png" alt-text="Screenshot of the Current role assignment in Access control in resource group for Azure Local deployment." lightbox="./media/deployment-arc-register-server-permissions/add-role-assignment-4.png":::-->
235
-
236
195
1. In the Azure portal go to **Microsoft Entra Roles and Administrators** and assign the **Cloud Application Administrator** role permission at the Microsoft Entra tenant level.
237
196
238
197
:::image type="content" source="media/deployment-arc-register-server-permissions/cloud-application-administrator-role-at-tenant.png" alt-text="Screenshot of the Cloud Application Administrator permission at the tenant level." lightbox="./media/deployment-arc-register-server-permissions/cloud-application-administrator-role-at-tenant.png":::
- Download the software and [Install the Azure Stack HCI operating system, version 23H2](../includes/../deploy/deployment-install-os.md) on each machine.
-**Register required resource providers.** Make sure that your Azure subscription is registered against the required resource providers. To register, you must be an owner or contributor on your subscription. You can also ask an administrator to register.
13
+
14
+
Run the following [PowerShell commands](/azure/azure-resource-manager/management/resource-providers-and-types#azure-powershell) to register:
> The assumption is that the person registering the Azure subscription with the resource providers is a different person than the one who is registering the Azure Local machines with Arc.
30
+
31
+
-**Create a resource group**. Follow the steps to [Create a resource group](/azure/azure-resource-manager/management/manage-resource-groups-portal#create-resource-groups) where you want to register your machines. Make a note of the resource group name and the associated subscription ID.
32
+
33
+
-**Get the tenant ID**. Follow the steps in [Get the tenant ID of your Microsoft Entra tenant through the Azure portal](/azure/azure-portal/get-subscription-tenant-id):
34
+
35
+
1. In the Azure portal, go to **Microsoft Entra ID** > **Properties**.
36
+
37
+
1. Scroll down to the Tenant ID section and copy the **Tenant ID** value to use later.
38
+
39
+
-**Verify permissions**. As you register machines as Arc resources, make sure that you're either the resource group owner or have the following permissions on the resource group where the machines are provisioned:
To verify that you have these roles, follow these steps in the Azure portal:
45
+
46
+
1. Go to the subscription you used for the Azure Local deployment.
47
+
48
+
1. Go to the resource group where you plan to register the machine.
49
+
50
+
1. In the left-pane, go to **Access Control (IAM)**.
51
+
52
+
1. In the right-pane, go to **Role assignments**. Verify that you have `Azure Connected Machine Onboarding` and `Azure Connected Machine Resource Administrator` roles assigned.
53
+
54
+
- Check your Azure policies. Make sure that:
55
+
- The Azure policies aren't blocking the installation of extensions.
56
+
- The Azure policies aren't blocking the creation of certain resource types in a resource group.
57
+
- The Azure policies aren't blocking the resource deployment in certain locations.
0 commit comments