You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article describes how to use the Role-based Access Control (RBAC) to control access to Arc virtual machines (VMs) running on Azure Local.
15
+
This article describes how to use the Role-based Access Control (RBAC) to control access to Azure Local virtual machines (VMs) enabled by Azure Arc.
16
16
17
17
You can use the builtin RBAC roles to control access to VMs and VM resources such as virtual disks, network interfaces, VM images, logical networks and storage paths. You can assign these roles to users, groups, service principals and managed identities.
18
18
@@ -26,14 +26,12 @@ To control access to VMs and VM resources on Azure Local, you can use the follow
26
26
27
27
Here's a table that describes the VM actions granted by each role for the VMs and the various VM resources. The VM resources are referred to resources required to create a VM and include virtual disks, network interfaces, VM images, logical networks, and storage paths:
28
28
29
-
30
29
| Builtin role | VMs | VM resources |
31
30
|--|--|--|
32
31
| Azure Stack HCI Administrator | Create, list, delete VMs<br><br> Start, stop, restart VMs | Create, list, delete all VM resources including logical networks, VM images, and storage paths |
33
32
| Azure Stack HCI VM Contributor | Create, list, delete VMs<br><br> Start, stop, restart VMs | Create, list, delete all VM resources except logical networks, VM images, and storage paths |
34
33
| Azure Stack HCI VM Reader | List all VMs | List all VM resources |
35
34
36
-
37
35
## Prerequisites
38
36
39
37
Before you begin, make sure to complete the following prerequisites:
@@ -44,18 +42,17 @@ Before you begin, make sure to complete the following prerequisites:
44
42
45
43
## Assign RBAC roles to users
46
44
47
-
You can assign RBAC roles to user via the Azure portal. Follow these steps to assign RBAC roles to users:
45
+
You can assign RBAC roles to users via the Azure portal. Follow these steps to assign RBAC roles to users:
48
46
49
47
1. In the Azure portal, search for the scope to grant access to, for example, search for subscriptions, resource groups, or a specific resource. In this example, we use the subscription in which your Azure Local is deployed.
50
48
51
-
52
-
1. Go to your subscription and then go to **Access control (IAM) > Role assignments**. From the top command bar, select **+ Add** and then select **Add role assignment**.
49
+
1. Go to your subscription and then go to **Access control (IAM)** > **Role assignments**. From the top command bar, select **+ Add** and then select **Add role assignment**.
53
50
54
51
If you don't have permissions to assign roles, the **Add role assignment** option is disabled.
55
52
56
53
:::image type="content" source="./media/assign-vm-rbac-roles/add-role-assignment-1.png" alt-text="Screenshot showing RBAC role assignment in Azure portal for your Azure Local." lightbox="./media/assign-vm-rbac-roles/add-role-assignment-1.png":::
57
54
58
-
1. On the **Role** tab, select an RBAC role to assign and choose from one of the following builtin roles:
55
+
1. On the **Role** tab, select an RBAC role to assign and select one of the following builtin roles:
59
56
60
57
-**Azure Stack HCI Administrator**
61
58
-**Azure Stack HCI VM Contributor**
@@ -71,7 +68,7 @@ You can assign RBAC roles to user via the Azure portal. Follow these steps to as
71
68
72
69
:::image type="content" source="./media/assign-vm-rbac-roles/add-role-assignment-4.png" alt-text="Screenshot showing Review + assign tab during role assignment in Azure portal for your Azure Local instance." lightbox="./media/assign-vm-rbac-roles/add-role-assignment-4.png":::
73
70
74
-
1. Verify the role assignment. Go to **Access control (IAM) > Check access > View my access**. You should see the role assignment.
71
+
1. Verify the role assignment. Go to **Access control (IAM)** > **Check access** > **View my access**. You should see the role assignment.
75
72
76
73
:::image type="content" source="./media/assign-vm-rbac-roles/add-role-assignment-5.png" alt-text="Screenshot showing newly assigned role in Azure portal for your Azure Local instance." lightbox="./media/assign-vm-rbac-roles/add-role-assignment-5.png":::
After you deploy Azure Arc virtual machines (VMs), you might need to add or delete resources such as data disks and network interfaces. This article describes how to manage these VM resources for an Azure Arc VM running on your Azure Local instance.
15
+
After you deploy Azure Local virtual machines (VMs) enabled by Azure Arc, you might need to add or delete resources such as data disks and network interfaces. This article describes how to manage these VM resources for an Azure Local VM running on your Azure Local instance.
16
16
17
17
You can add or delete the resources by using the Azure portal. For the task of adding a data disk, you can also use the Azure CLI.
18
18
19
19
## Prerequisites
20
20
21
-
- Access to an Azure Local instance that's deployed and registered. You should have one or more Azure Arc VMs running on this system. For more information, see [Create Azure Arc virtual machines on Azure Local](./create-arc-virtual-machines.md).
21
+
- Access to an Azure Local instance that's deployed and registered. You should have one or more Azure Local VMs running on this system. For more information, see [Create an Azure Local VM enabled by Azure Arc](./create-arc-virtual-machines.md).
22
22
23
23
## Add a data disk
24
24
@@ -120,7 +120,7 @@ Follow these steps in the Azure portal for your Azure Local instance:
120
120
121
121
:::image type="content" source="./media/manage-arc-virtual-machine-resources/add-network-interface-3.png" alt-text="Screenshot of the Apply button on the Networking pane for a virtual machine." lightbox="./media/manage-arc-virtual-machine-resources/add-network-interface-3.png":::
122
122
123
-
1. You get a notification that the job for network interface creation started. After the network interface is created, it's attached to the Azure Arc VM.
123
+
1. You get a notification that the job for network interface creation started. After the network interface is created, it's attached to the Azure Local VM.
124
124
125
125
:::image type="content" source="./media/manage-arc-virtual-machine-resources/add-network-interface-4.png" alt-text="Screenshot of the Notifications pane for network interface creation beside the Networking pane for a virtual machine." lightbox="./media/manage-arc-virtual-machine-resources/add-network-interface-4.png":::
126
126
@@ -143,7 +143,7 @@ Follow these steps in the Azure portal for your Azure Local instance.
143
143
144
144
:::image type="content" source="./media/manage-arc-virtual-machine-resources/delete-network-interface-2.png" alt-text="Screenshot of the confirmation dialog for deleting a network interface." lightbox="./media/manage-arc-virtual-machine-resources/delete-network-interface-2.png":::
145
145
146
-
1. Select **Apply** to apply the changes. The network interface is dissociated from the Azure Arc VM.
146
+
1. Select **Apply** to apply the changes. The network interface is dissociated from the Azure Local VM.
147
147
148
148
:::image type="content" source="./media/manage-arc-virtual-machine-resources/delete-network-interface-3.png" alt-text="Screenshot of the Apply button on the Networking pane for a VM." lightbox="./media/manage-arc-virtual-machine-resources/delete-network-interface-3.png":::
149
149
@@ -153,4 +153,4 @@ Follow these steps in the Azure portal for your Azure Local instance.
153
153
154
154
## Related content
155
155
156
-
-[Manage VM extensions on Azure Local virtual machines](./virtual-machine-manage-extension.md)
156
+
-[Manage VM extensions on Azure Local virtual machines](./virtual-machine-manage-extension.md).
This article introduces Trusted launch for Azure Arc virtual machines (VMs) on Azure Local. You can create a Trusted launch Arc VM using Azure portal or by using Azure Command-Line Interface (CLI).
16
-
15
+
This article introduces Trusted launch for Azure Local virtual machines (VMs) enabled by Azure Arc. You can create a Trusted launch for an Azure Local VM using the Azure portal or by using Azure Command-Line Interface (CLI).
17
16
18
17
## Introduction
19
18
20
-
Trusted launch for Azure Arc VMs enables secure boot, installs a virtual Trusted Platform Module (vTPM) device, automatically transfers the vTPM state when the VM migrates or fails over to another machine within the system, and supports the ability to attest whether the VM started in a known good state.
19
+
Trusted launch for Azure Local VMs enable secure boot, installs a virtual Trusted Platform Module (vTPM) device, automatically transfers the vTPM state when the VM migrates or fails over to another machine within the system, and supports the ability to attest whether the VM started in a known good state.
21
20
22
-
Trusted launch is a security type that can be specified when creating Arc VMs on Azure Local. For more information, see [Trusted launch for Azure Arc VMs on Azure Local](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/trusted-launch-for-azure-arc-vms-on-azure-stack-hci-version-23h2/ba-p/3978051).
21
+
Trusted launch is a security type that can be specified when creating Azure Local VMs. For more information, see [Trusted launch for Azure Local VMs enabled by Azure Arc](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/trusted-launch-for-azure-arc-vms-on-azure-stack-hci-version-23h2/ba-p/3978051).
23
22
24
23
## Capabilities and benefits
25
24
@@ -35,32 +34,32 @@ Trusted launch is a security type that can be specified when creating Arc VMs on
35
34
36
35
## Guidance
37
36
38
-
- IgvmAgent is a component that is installed on all machines in the Azure Local system. It enables support for isolated VMs such as Trusted launch Arc VMs for example.
37
+
- IgvmAgent is a component that is installed on all machines in the Azure Local system. It enables support for isolated VMs like Trusted launch for Azure Local VMs, for example.
39
38
40
-
- As part of Trusted launch Arc VM creation, Hyper-V creates VM files at a default location on disk to store the VM state. By default, access to those VM files is restricted to host server administrators only. If you store those VM files in a different location, you must ensure that the location is access restricted to host server administrators only.
39
+
- As part of Trusted launch for Azure Local VM creation, Hyper-V creates VM files at a default location on disk to store the VM state. By default, access to those VM files is restricted to host server administrators only. If you store those VM files in a different location, you must ensure that the location is access restricted to host server administrators only.
41
40
42
41
- VM live migration network traffic is not encrypted. We strongly recommend that you enable a network layer encryption technology such as IPsec to protect live migration network traffic.
43
42
44
43
<!--- VM live migration network traffic is not encrypted. We strongly recommend that you enable IPsec to protect live migration network traffic. For more information, see [Network Recommendations for a Hyper-V Cluster](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn550728(v=ws.11)#How_to_isolate_the_network_traffic_on_a_Hyper-V_cluster).-->
45
44
46
45
## Guest operating system images
47
46
48
-
All Windows 11 images (excluding 24H2 Windows 11 SKUs) and Windows Server 2022 images from Azure Marketplace supported by Azure Arc VMs are supported. See [Create Azure Local VM image using Azure Marketplace images](/azure-stack/hci/manage/virtual-machine-image-azure-marketplace?tabs=azurecli) for a list of all supported Windows 11 images.
47
+
All Windows 11 images (excluding 24H2 Windows 11 SKUs) and Windows Server 2022 images from Azure Marketplace supported by Azure Local VMs are supported. See [Create Azure Local VM image using Azure Marketplace images](/azure-stack/hci/manage/virtual-machine-image-azure-marketplace?tabs=azurecli) for a list of all supported Windows 11 images.
49
48
50
49
> [!NOTE]
51
50
> VM guest images obtained outside of Azure Marketplace are not supported.
52
51
53
52
## Backup and disaster recovery considerations
54
53
55
-
When working with Trusted launch Arc VMs, make sure to understand the following key considerations and limitations related to backup and recovery:
54
+
When working with Trusted launch for Azure Local VMs, make sure to understand the following key considerations and limitations related to backup and recovery:
56
55
57
-
-**Differences between Trusted launch Arc VMs and standard Arc VMs**: Unlike standard Azure Arc VMs, Trusted launch Arc VMs use a VM guest state protection key to protect the VM guest state, including the virtual TPM (vTPM) state, while at rest. The VM protection key is stored in a local key vault in the Azure Local system where the VM resides. Trusted launch Arc VMs store the VM guest state in two files: VM guest state and VM runtime state. To back up and restore a Trusted launch VM, a backup solution must back up and restore all the VM files, including guest state and the runtime state files, and additionally backup and restore the VM protection key.
56
+
-**Differences between Trusted launch for Azure Local VMs and standard Azure Local VMs**: Unlike standard Azure Local VMs, Trusted launch for Azure Local VMs use a VM guest state protection key to protect the VM guest state, including the virtual TPM (vTPM) state, while at rest. The VM protection key is stored in a local key vault in the Azure Local system where the VM resides. Trusted launch for Azure Local VMs store the VM guest state in two files: VM guest state and VM runtime state. To back up and restore a Trusted launch VM, a backup solution must back up and restore all the VM files, including guest state and the runtime state files, and additionally backup and restore the VM protection key.
58
57
59
-
-**Backup and disaster recovery tooling support**: Currently, Trusted launch Arc VMs do not support any third-party or Microsoft-owned back up and disaster recovery tools, including but not limited to, Azure Backup, Azure Site Recovery, Veeam, and Commvault. If there arises a need to move a Trusted launch Arc TVM to an alternate cluster, see the manual process [Manual backup and recovery of Trusted launch Arc VMs](./trusted-launch-vm-import-key.md) to manage all the necessary files and VM protection key to ensure that the VM can be successfully restored.
58
+
-**Backup and disaster recovery tooling support**: Currently, Trusted launch for Azure Local VMs do not support any third-party or Microsoft-owned back up and disaster recovery tools, including but not limited to, Azure Backup, Azure Site Recovery, Veeam, and Commvault. If there arises a need to move a Trusted launch for Azure Local TVM to an alternate cluster, see the manual process [Manual backup and recovery of Trusted launch for Azure Local VMs](./trusted-launch-vm-import-key.md) to manage all the necessary files and VM protection key to ensure that the VM can be successfully restored.
60
59
61
60
> [!NOTE]
62
-
> Trusted launch Arc VMs restored on an alternate Azure Local system cannot be managed from the Azure control plane.
61
+
> Trusted launch for Azure Local VMs restored on an alternate Azure Local system cannot be managed from the Azure control plane.
0 commit comments