Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2504 and Microsoft 2501
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2504 release and the Microsoft 2501 release.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2504 release and Microsoft 2501 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2501 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2501 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2504 and Microsoft 2501
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2504 release and the Microsoft 2501 release.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2504 release and Microsoft 2501 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2501 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2501 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2502 and Microsoft 2501
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2502 release and the Microsoft 2501 release.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2502 release and Microsoft 2501 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2501 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2501 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2502 and Microsoft 2501
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2502 release and the Microsoft 2501 release.
New features, changed features, and fixes
New features
Initial release of the Dell Integrated System for Microsoft Azure Stack Hub Lifecycle Manager which provides an automated way of upgrading Hardware Lifecycle Host (HLH) firmware, software and driver components. See Patch and Update for 16G.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2502 release and Microsoft 2501 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2501 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2501 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2411 and Microsoft 2408
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2411 release and the Microsoft 2408 release.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2411 release and Microsoft 2408 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2408 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2408 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub Release Notes
Current Release Version: Dell 2411 and Microsoft 2408
Release Type: Major (MA)
NOTE
Dell Azure Stack Hub OEM updates must be installed in sequential order, it is not supported to skip or miss-out an OEM update version. These release notes contain supplemental information for the Dell 2411 release and the Microsoft 2408 release.
This release notes document describes known issues and limitations for the Dell Integrated System for Microsoft Azure Stack Hub solution based on the Dell 2411 release and Microsoft 2408 release.
Item
Description
OEM update
Dell Technologies recommends updating to the n-1 version before applying the latest OEM package.
Microsoft Azure Stack Hub code
For information about known issues and limitations in the Microsoft Azure Stack Hub code, see the Azure Stack Hub 2408 update on the Microsoft website
Notes and warnings
CAUTION
Before you use the Microsoft Patch and Update process to update Azure Stack Hub, close any active session to the ERCS virtual machines. If an active session is open, the update may fail, and must be resumed.
Microsoft fixed issues
For information about fixed issues in this release, see the Azure Stack Hub 2408 update on the Microsoft website.
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2504 release and Microsoft 2501 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2504 release and Microsoft 2501 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated System for Microsoft Azure Stack Hub OEM extension package with drivers and firmware updates
AzSHub_16G_Dell2504.2_OEMPackage.zip
2504.2
Dell Integrated System for Microsoft Azure Stack Hub HLH ISO
MS2406_Dell2504.6.iso
2504.6
Dell Integrated System for Microsoft Azure Stack Hub Lifecycle Manager
AzSHub_Dell2504.2_LifecycleManager.zip
2504.2
3.2 - Support Matrix for 2502
3.2.1 - Support Matrix for 14G - 2502
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2502 release and Microsoft 2501 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2502 release and Microsoft 2501 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated Systems for Microsoft Azure Stack Hub OEM extension package with drivers and firmware updates
AzSHub_16G_Dell2502.3_OEMPackage.zip
2502.3
Dell Integrated Systems for Microsoft Azure Stack Hub HLH ISO
MS2406_Dell2502.5.iso
2502.5
Dell Integrated Systems for Microsoft Azure Stack Hub Lifecycle Manager
AzSHub_Dell2502.32_LifecycleManager.zip
2502.32
3.3 - Support Matrix for 2411
3.3.1 - Support Matrix for 14G - 2411
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2411 release and Microsoft 2408 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated System for Microsoft Azure Stack Hub - Valid from Dell 2411 release and Microsoft 2408 release
Abstract
This support matrix provides information about supported software and hardware configurations for Dell Integrated System for Microsoft Azure Stack Hub.
Introduction
The Dell Integrated System for Microsoft Azure Stack Hub Support Matrix describes supported drivers, firmware, applications, and hardware for Dell Integrated System for Microsoft Azure Stack Hub.
NOTE
All references to release dates refer to Dell Technologies releases, unless otherwise indicated.
Dell Integrated Systems for Microsoft Azure Stack Hub OEM extension package with drivers and firmware updates
AzSHub_16G_Dell2411.6_OEMPackage.zip
2411.6
Dell Integrated Systems for Microsoft Azure Stack Hub HLH ISO
MS2406_Dell2411.10.iso
2411.10
4 - Node Expansion
4.1 - Node Expansion for 16G
Introduction
This document will guide users through how to add one or more scale unit nodes to their Dell Integrated System for Microsoft Azure Stack Hub that is fully installed and operational.
The only way to increase the capacity of an Azure Stack Hub integrated system is to add more physical computers to the existing scale unit. The scale unit is a collection of physical computers that work together to provide compute, storage, and networking resources. Each physical computer in the scale unit is referred to as a scale unit node.
In order to add a scale unit node, you will need to physically rack, stack, and cable the new node(s), configure Top-of-Rack (ToR) switches, ensure firmware and BIOS configuration match the existing nodes, and add the new node(s) to the Azure Stack Hub integrated system via the Azure Stack Hub administrator portal. This document will guide you through this process.
NOTE
A single scale unit can support up to 16 nodes. You can add scale unit nodes to a scale unit until it reaches its maximum capacity.
Audience
This node expansion guide is for Azure Stack Hub 16th-generation (16G) operators and the Dell Customer Service team who intend to add scale unit nodes to an existing Azure Stack Hub integrated system.
End-to-end deployment workflow
Node expansion workflow
Prerequisites
Ensure the following before you can add a node:
Administrator access to the Azure Stack Hub integrated system.
The rack and the power distribution unit (PDU) must be able to accommodate the new nodes.
New scale unit (SU) nodes must use the same hardware configuration as the existing Azure Stack Hub scale unit nodes.
The Azure Stack Hub integrated system must have the most current Microsoft and Dell Technologies patches and updates. If it does not, update it with the most recent patches and update versions before starting the node expansion process.
The Azure Stack Hub integrated system must be healthy. Check the health state by logging in to the Azure Stack Hub administrator portal. Any active health alerts must be resolved before adding a scale unit node.
Rack, stack, and cable physical nodes
After the new scale unit node or nodes arrive at the customer site, on-site engineers must perform the manual process to rack, stack, and cable the new node(s).
Refer to the following diagrams for Top-of-Rack (ToR) switches cabling guidance.
Scale unit node to ToR-1 network cabling
Scale unit node to ToR-2 network cabling
Scale unit node to ToR-1 iDRAC cabling
Scale unit node to ToR-2 iDRAC cabling
Check Component Readiness
After the new scale unit node or nodes are racked and cabled, power on the new node or nodes and check the LED indicator lights to ensure that all power supply and network cables are connected. See steps below on checking power readiness and checking network fabric connectivity before proceeding with a scale unit node expansion.
Check Power Readiness
To check power readiness, perform the following steps:
Steps
Use a separate power bus for each power distribution unit (PDU).
Ensure that the PDUs are firmly connected to the applicable power sources.
Ensure that the PDUs are powered on.
All servers and switches are equipped with dual power supplies. Ensure that these power supplies are connected to separate PDUs to ensure power redundancy.
Checking network fabric connectivity
Ensure that the new and existing scale unit nodes are connected to the ToR switches.
The odd numbered nodes iDRAC (OoB) port connects to the ToR-1 switch.
The even numbered nodes iDRAC (OoB) port connects to the ToR-2 switch.
The Slot 6 Port 1 port is connected to the ToR-1 switch.
The Slot 6 Port 2 port is connected to the ToR-2 switch.
The following figure shows the port locations for an AS-760 server.
Port Locations for AS-760
S5248F-ON ToR-1 port map
The following table lists the Slot 6 Port 1 connections, cable types, node ports, and switch ports to the S5248F-ON ToR-1 switch.
Origin
Destination
Cable Type
ToR-1 Port 1
Slot 6 Port 1 on Node 1 (AS-760)
25 GbE Twinax
ToR-1 Port 2
Slot 6 Port 1 on Node 2 (AS-760)
25 GbE Twinax
ToR-1 Port 3
Slot 6 Port 1 on Node 3 (AS-760)
25 GbE Twinax
ToR-1 Port 4
Slot 6 Port 1 on Node 4 (AS-760)
25 GbE Twinax
ToR-1 Port 5
Slot 6 Port 1 on Node 5 (AS-760)
25 GbE Twinax
ToR-1 Port 6
Slot 6 Port 1 on Node 6 (AS-760)
25 GbE Twinax
ToR-1 Port 7
Slot 6 Port 1 on Node 7 (AS-760)
25 GbE Twinax
ToR-1 Port 8
Slot 6 Port 1 on Node 8 (AS-760)
25 GbE Twinax
ToR-1 Port 9
Slot 6 Port 1 on Node 9 (AS-760)
25 GbE Twinax
ToR-1 Port 10
Slot 6 Port 1 on Node 10 (AS-760)
25 GbE Twinax
ToR-1 Port 11
Slot 6 Port 1 on Node 11 (AS-760)
25 GbE Twinax
ToR-1 Port 12
Slot 6 Port 1 on Node 12 (AS-760)
25 GbE Twinax
ToR-1 Port 13
Slot 6 Port 1 on Node 13 (AS-760)
25 GbE Twinax
ToR-1 Port 14
Slot 6 Port 1 on Node 14 (AS-760)
25 GbE Twinax
ToR-1 Port 15
Slot 6 Port 1 on Node 15 (AS-760)
25 GbE Twinax
ToR-1 Port 16
Slot 6 Port 1 on Node 16 (AS-760)
25 GbE Twinax
The following table lists the iDRAC connections, cable types, node ports, and switch ports to the S5248F-ON ToR-1 switch.
Origin
Destination
Cable Type
ToR-1 Port 25
iDRAC on Node 1 (AS-760)
1GbE Cat-6
ToR-1 Port 26
iDRAC on Node 3 (AS-760)
1GbE Cat-6
ToR-1 Port 27
iDRAC on Node 5 (AS-760)
1GbE Cat-6
ToR-1 Port 28
iDRAC on Node 7 (AS-760)
1GbE Cat-6
ToR-1 Port 29
iDRAC on Node 9 (AS-760)
1GbE Cat-6
ToR-1 Port 30
iDRAC on Node 11 (AS-760)
1GbE Cat-6
ToR-1 Port 31
iDRAC on Node 13 (AS-760)
1GbE Cat-6
ToR-1 Port 32
iDRAC on Node 15 (AS-760)
1GbE Cat-6
S5248F-ON ToR-2 port map
The following table lists the Slot 6 Port 2 connections, cable types, node ports, and switch ports to the S5248F-ON ToR-2 switch.
Origin
Destination
Cable Type
ToR-2 Port 1
Slot 6 Port 2 on Node 1 (AS-760)
25 GbE Twinax
ToR-2 Port 2
Slot 6 Port 2 on Node 2 (AS-760)
25 GbE Twinax
ToR-2 Port 3
Slot 6 Port 2 on Node 3 (AS-760)
25 GbE Twinax
ToR-2 Port 4
Slot 6 Port 2 on Node 4 (AS-760)
25 GbE Twinax
ToR-2 Port 5
Slot 6 Port 2 on Node 5 (AS-760)
25 GbE Twinax
ToR-2 Port 6
Slot 6 Port 2 on Node 6 (AS-760)
25 GbE Twinax
ToR-2 Port 7
Slot 6 Port 2 on Node 7 (AS-760)
25 GbE Twinax
ToR-2 Port 8
Slot 6 Port 2 on Node 8 (AS-760)
25 GbE Twinax
ToR-2 Port 9
Slot 6 Port 2 on Node 9 (AS-760)
25 GbE Twinax
ToR-2 Port 10
Slot 6 Port 2 on Node 10 (AS-760)
25 GbE Twinax
ToR-2 Port 11
Slot 6 Port 2 on Node 11 (AS-760)
25 GbE Twinax
ToR-2 Port 12
Slot 6 Port 2 on Node 12 (AS-760)
25 GbE Twinax
ToR-2 Port 13
Slot 6 Port 2 on Node 13 (AS-760)
25 GbE Twinax
ToR-2 Port 14
Slot 6 Port 2 on Node 14 (AS-760)
25 GbE Twinax
ToR-2 Port 15
Slot 6 Port 2 on Node 15 (AS-760)
25 GbE Twinax
ToR-2 Port 16
Slot 6 Port 2 on Node 16 (AS-760)
25 GbE Twinax
The following table lists the iDRAC connections, cable types, node ports, and switch ports to the S5248F-ON ToR-2 switch.
Origin
Destination
Cable Type
ToR-2 Port 25
iDRAC on Node 2 (AS-760)
1GbE Cat-6
ToR-2 Port 26
iDRAC on Node 4 (AS-760)
1GbE Cat-6
ToR-2 Port 27
iDRAC on Node 6 (AS-760)
1GbE Cat-6
ToR-2 Port 28
iDRAC on Node 8 (AS-760)
1GbE Cat-6
ToR-2 Port 29
iDRAC on Node 10 (AS-760)
1GbE Cat-6
ToR-2 Port 30
iDRAC on Node 12 (AS-760)
1GbE Cat-6
ToR-2 Port 31
iDRAC on Node 14 (AS-760)
1GbE Cat-6
ToR-2 Port 32
iDRAC on Node 16 (AS-760)
1GbE Cat-6
Configure ToR Switches
Using a crash cart with a serial connection or an SSH connection to the ToR switches, ensure that all ports that have a new node connected have been configured correctly.
To configure the ToR switches, perform the following steps:
Steps
Log in to the S5248F-ON ToR-1 switch
Once logged in type the commands below to configure the data link connections to the newly added scale unit nodes. For example, if wishing to expand a four-node scale unit with additional four nodes, you would run the below on the switch:
conf t
interface range ethernet 1/1/5-1/1/8
description "CL01 Nodes NIC"
no shutdown
switchport mode trunk
switchport access vlan 7
switchport trunk allowed vlan 107
mtu 9216
flowcontrol receive off
priority-flow-control mode on
service-policy input type network-qos AZS_SERVICES_pfc
service-policy output type queuing AZS_SERVICES_ets
ets mode on
qos-map traffic-class AZS_SERVICES_Que
spanning-tree bpduguard enable
spanning-tree guard root
spanning-tree port type edge
exit
Once the data link port or ports are configured on the switch proceed to configuring the BMC Management ports. For example, if wishing to expand a four-node scale unit with an additional four nodes, you would run the below on the switch:
conf t
interface range ethernet 1/1/27:1-1/1/28:1
description "BMCMgmt Ports"
no shutdown
switchport access vlan 125
mtu 9216
flowcontrol receive off
spanning-tree bpduguard enable
spanning-tree guard root
end
Once the BMC Management port or ports have been configured you will need to run the command below to write the new configuration into memory on the switch:
copy running-configuration startup-configuration
Once you have completed steps 1-4, repeat them on the ToR-2 switch.
Accessing the iDRAC Direct port
The iDRAC Direct port is a USB port located on the front of the server and is used to access the iDRAC web interface, RACADM, and Redfish API, without needing to connect to the network.
NOTE
The factory default defined iDRAC administrator credential username will be azsinstall and the password will be azsinstall. This credential will be rotated as part of the node expansion process.
To access the iDRAC Direct port, perform the following steps:
Steps
To access the iDRAC Direct port, you must connect a USB Type A to micro-USB cable from a laptop or mobile KVM host to the micro-USB port on the front of the server.
From your host, turn off any wireless networks and disconnect from any other hard-wired networks.
Connect a USB Type A to micro-USB cable from your host to the iDRAC Direct micro-USB port located on the front control panel of the AS-760 server.
AS-760 front view with iDRAC Direct port highlighted
Wait for the host to acquire an IP address of 169.254.0.4. It may take several seconds for the IP address to be acquired. The iDRAC will acquire an IP address of 169.254.0.3.
Open a web browser and provide the iDRAC Direct port IP address as the URL. For example, https://169.254.0.3.
At the certificate warning window, click Advanced and then click Proceed to 169.254.0.3 (unsafe).
Certificate warning window
Enter the factory default username and password for the iDRAC, and click Log In.
iDRAC 9 login screen
Assigning iDRAC IP addresses to the new scale unit nodes for expansion
The iDRAC IP address assignment is a manual step. The iDRAC Direct port can be leveraged on the node(s) to assign the iDRAC IP addresses based on the assigned BMC management (BMCMgmt) network IP address from the Azure Stack Hub deployment worksheet.
To manually assign the iDRAC IP addresses to the new scale unit nodes for expansion, perform the following steps:
Steps
The below steps will be repeated for each new scale unit node to be added.
From the iDRAC dashboard, browse to iDRAC Settings > Connectivity and expand the Network > IPv4 Settings menu.
iDRAC Settings > Network > IPv4 Settings menu
Set the static IP address, static gateway, and static subnet mask according to the values defined in the Azure Stack Hub deployment worksheet. These IP addresses are defined by the BMCMgmt /26 subnet provided to the deployment worksheet.
Prior to running the node expansion script, it is important to perform a quick health check of the new node(s). This also allows the iDRAC to perform an inventory collection which is needed for the firmware upgrade automation to successfully validate the new node(s).
To perform a health check on the new nodes for expansion, perform the following steps:
Steps
The below steps will be repeated for each new scale unit node to be added.
If the new node(s) are powered off, press the power button to boot the new node(s).
Allow up to 10 minutes for the new node(s) to fully load BIOS settings and complete the BIOS initialization.
Once complete, access the iDRAC web interface either via the iDRAC Direct port or by leveraging a remote desktop (RDP) connection from the Hardware Lifecycle Host (HLH).
Verify there are no alerts or warnings on the dashboard.
Navigate to System > Overview > Network Devices and verify that NIC Slot 6 shows both ports with a Link Status of Up.
Navigate to Storage > Overview > Physical Disks and verify all drives are present and healthy.
Navigate to Storage > Overview > Virtual Disks and verify a virtual disk is present.
Once complete, navigate back to the Dashboard and power off the node.
Update firmware on new scale unit nodes
This section covers updating firmware on scale unit node(s).
WARNING
To maintain the integrity of Dell Azure Stack Hub Integrated System before adding any new scale unit nodes, you must first follow the Patch and Update guide which includes Lifecycle Manager, ToR switch firmware updates, and OEM package updates.
This will ensure that any new scale unit nodes have the correct firmware and BIOS configuration applied when they are added to the cluster.
Node expansion script
The node expansion script is used to update firmware and apply BIOS configuration on the new scale unit node(s) before they are added to the Azure Stack Hub integrated system.
The script will also update the DeploymentData JSON file with the new scale unit node(s) information.
The script will not add the new scale unit node(s) to the Azure Stack Hub integrated system, see the Add scale unit node in the Azure Stack Hub administrator portal section for more information on how to add the new scale unit node(s) to the Azure Stack Hub integrated system.
Dell Integrated System for Microsoft Azure Stack Hub Lifecycle Manager contains the node expansion script, Invoke-DellAzSHubNodeExpansion.ps1. After completing the Patch and Update process, you should have the latest Lifecycle Manager available in E:\LCM.
WARNING
Ensure that the new scale unit node(s) are powered off before running the Invoke-DellAzSHubNodeExpansion.ps1 script, otherwise the script will fail.
NOTE
The factory default defined iDRAC administrator credential username is azsinstall and the password is azsinstall.
To run the node expansion script, perform the following steps:
Steps
From the HLH, open a PowerShell console window as an administrator.
Before running the node expansion script, make sure you have the following information:
Number of nodes being added
Factory BMC user credentials
BMC administrator credentials
HLH administrator credentials
Change the directory to E:\LCM
Set-Location -Path E:\LCM
Run the following command to start the expansion process. Change the “X” to the number of nodes that are being added.
.\Invoke-DellAzSHubNodeExpansion.ps1 -AdditionalNodeCount X
You will be prompted to input the BMC user, BMC administrator and HLH administrator credentials before the upgrade begins.
The automation will run the firmware update process one node at a time. Each node will take about an hour to complete.
Once the firmware update process is complete on all nodes your prompt will look as shown below. The new nodes have now been added to the DeploymentData JSON file and are ready to be added to the cluster from the Azure Stack Hub administrator portal:
(...)
VERBOSE: 20250214-225038:Invoke-FirmwarePostUpdate:Invoke-OEMFirmwarePostUpdate completed successfully.
VERBOSE: 20250214-225038:Remove-AutoLogon:Removing auto admin logon.
VERBOSE: 20250214-225038:Resume-HLHBitLocker:Importing BitLocker module.
VERBOSE: 20250214-225038:Resume-HLHBitLocker:Getting BitLocker encrypted volumes.
VERBOSE: 20250214-225039:Resume-HLHBitLocker:Restoring TPM protector on volume 'D:'.
VERBOSE: 20250214-225039:Disable-DHCPServer:Disabling DHCP server service.
VERBOSE: 20250214-225039:Invoke-OEMFirmwareBootstrap:PROGRESS - Cleanup complete.
VERBOSE: 20250214-225039:Invoke-OEMFirmwareBootstrap:PROGRESS - Invoke-OEMFirmwareBootstrap completed successfully.
Finished running Invoke-FirmwareBootstrap for sac42-S1-N08 - 10.128.164.74 with Deployment Data JSON: E:\AzureStack\DeploymentData_new_one.json
> List of nodes in the Deployment Data JSON: 'E:\AzureStack\DeploymentData_new_one.json'.
Name BMCIPAddress
---- ------------
sac42-S1-N01 10.128.164.67
sac42-S1-N02 10.128.164.68
sac42-S1-N03 10.128.164.69
sac42-S1-N04 10.128.164.70
sac42-S1-N05 10.128.164.71
sac42-S1-N06 10.128.164.72
sac42-S1-N07 10.128.164.73
sac42-S1-N08 10.128.164.74
(...)
> Successfully replaced the original Deployment Data JSON with the new one.
Locate Logs
To locate the logs from the node expansion script, perform the following steps:
Steps
From the HLH, open File Explorer and navigate to the C:\MASLogs folder.
The logs that were generated from the node expansion script will have the filename: OEMFirmwareUpdate_[date]-[time].
Add scale unit node in the Azure Stack Hub administrator portal
The operation to add a scale unit node consists of two distinct phases: compute and storage.
The compute expansion process can take between 1-3 hours to complete per scale unit node. The storage expansion process can take several days to complete, depending on the size of the storage pool and the number of scale unit nodes being added.
NOTE
To perform any tasks within the Azure Stack Hub administrator portal, you must have the necessary administrator privileges to the Default Provider Subscription.
Before adding a scale unit node within the Azure Stack Hub administrator portal, ensure that you have completed all the steps below:
While an add scale unit node operation is already in progress do not attempt any of the following operations:
Stop Azure Stack Hub
Update Azure Stack Hub
Repair/FRU scale unit node
Certificates rotation
Add another scale unit node (the previous add scale unit node operation failure is also considered in progress)
Steps
WARNING
Only one scale unit node can be added at a time during the compute expansion process. Once one scale unit node has been successfully added to the cluster, you can proceed with adding the next scale unit node.
Log into the Azure Stack Hub administrator portal as an Azure Stack Hub administrator.
Browse to All services > Region management > Scale units > [Cluster name] > Nodes.
Click the Add node button.
The Region and the Scale unit will be populated automatically. You will need to specify the BMC IP Address of the scale unit node you are adding.
Once you have entered the IP address of the new scale unit node, click Add at the bottom of the screen.
NOTE
The add node operation first adds the new scale unit node as available compute capacity and then automatically extends the storage capacity.
It will take a few minutes for the new scale unit node to be visible in the Azure Stack Hub administrator portal.
The new scale unit node will be in a Adding state until the compute expansion process is complete.
Click the notifications in the upper right to check the status as shown below:
Once the scale unit node expansion compute process is complete, your notifications will show as the following:
CAUTION
After a scale unit node is added, the storage expansion process begins and can run for multiple days before it completes the expansion.
In order to check the status of the storage expansion provisioning task you can navigate to All services > Region management > Scale units. Once here, you will see the status as Configuring Storage if the storage expansion provisioning task is not yet complete. When this task is complete the status will change to Running.
NOTE
You do not need to wait for the Configuring Storage task to complete before adding the next scale unit node.
There is no impact to the running workloads while another scale unit node is being added.
5 - Patch and Update
5.1 - Patch and Update for 16G
Introduction
Microsoft Azure Stack Hub operators are faced with the enormous challenge of keeping their solution both secure and functional. They must ensure that the solution is not vulnerable to threats, external or internal, while maintaining negotiated service-level agreements.
Solution overview
As a Microsoft Azure Stack Hub systems provider, Dell Technologies is committed to ensuring that your Azure Stack Hub environment is both secure and functional. In Dell Technologies releases, you will find firmware and driver updates for both the Hardware Lifecycle Host (HLH) and the scale unit (SU) nodes that are contained in the OEM package updates. Dell Technologies delivers these updates quarterly, and you can apply them independently of Microsoft updates.
There are two other types of update packages for the Azure Stack Hub integrated systems: software updates and hotfixes.
This patch and update guide is for Azure Stack Hub 16th-generation (16G) operators who intend to perform lifecycle operations (Patch and Update) for:
Firmware updates for the Hardware Lifecycle Host (HLH)
Operating System updates for the HLH (Windows Server 2022)
Driver updates for the HLH (Windows Server 2022)
Windows Defender Application Control (WDAC) policy updates for the HLH Operating System
Firmware updates for the Top-of-Rack (ToR) switches (S5248F-ON)
Firmware updates for the scale unit (SU) nodes
Driver updates for the scale unit nodes (Windows Server 2022)
Dell Integrated System for Microsoft Azure Stack Hub Lifecycle Manager overview
Dell Integrated System for Microsoft Azure Stack Hub Lifecycle Manager provides an automated way of upgrading HLH firmware, software, and driver components.
Lifecycle Manager will perform the following tasks:
Update firmware on the Hardware Lifecycle Host
Update drivers on the Hardware Lifecycle Host
Install Windows updates for the Hardware Lifecycle Host Operating System
Update the Windows Defender Application Control (WDAC) policy on the Hardware Lifecycle Host
NOTE
Firmware updates for the Top-of-Rack (ToR) switches are not included in the Lifecycle Manager update process and must be updated manually from the Hardware Lifecycle Host (HLH) using SCP and SSH commands. See the section Manually Updating the Switch Firmware from the Hardware Lifecycle Host (HLH) for more information.
Firmware and driver updates for scale unit (SU) nodes are not included in the Lifecycle Manager update process and must be updated manually using the Azure Stack Hub administrator portal. See the section OEM package updates for more information.
Lifecycle Manager should take between 1-2 hours to complete.
The Azure Stack Hub OEM package update contains firmware, device drivers, and hardware management tools in a specialized format used by Azure Stack Hub during initial deployment and update.
Dell Technologies is responsible for the end-to-end servicing lifecycle for the hardware-related firmware and driver update packages.
In addition, Dell Technologies will own and maintain guidance for all software and hardware on the HLH.
Perform the following steps before proceeding with the Lifecycle Manager update process. There are some steps which are a one-time-activity and some that you must perform in every release.
Download the Lifecycle Manager zip file
To download the latest Lifecycle Manager zip file, perform the following steps:
Log in to the HLH with the HLHAdmin default administrator account or a customer specified administrative user account.
The HLH can be accessed via Remote Desktop Protocol (RDP) from a Permitted Network or directly via the iDRAC Direct port (USB to Micro-USB) connection.
The Lifecycle Manager zip file version must match the version of the OEM package zip file, otherwise the Lifecycle Manager will not pass the pre-checks.
For example, if the Lifecycle Manager zip file is 2502, then the OEM package zip file must also be 2502.
Log in to the HLH with the HLHAdmin default administrator account or a customer specified administrative user account.
The HLH can be accessed via Remote Desktop Protocol (RDP) from a Permitted Network or directly via the iDRAC Direct port (USB to Micro-USB) connection.
Download the OEM package update zip file to the HLH E:\Temp directory.
Extract Lifecycle Manager and OEM package update zip files
Lifecycle Manager zip and OEM package update zip files that were downloaded to the HLH from the Dell support website will need to be extracted into their own directories.
To extract Lifecycle Manager and OEM package update zip files, perform the following steps:
Steps
Before beginning the extraction process, first the files in the E:\Temp directory will need to be unblocked. Open a PowerShell terminal as administrator and type the following command:
Lifecycle Manager zip file contents must be unblocked; otherwise, the Lifecycle Manager will not pass the pre-checks.
Once the contents within the E:\Temp directory have been unblocked, you can begin to extract the zip files into their directories.
On the HLH, navigate to the E:\ drive and create a folder named LCM.
On the HLH, navigate to the E:\ drive and create a folder named OEM.
Extract the Lifecycle Manager zip file from the E:\Temp directory to the E:\LCM directory.
Extract the OEM package update zip file from the E:\Temp directory to the E:\OEM directory.
Hardware Lifecycle Host (HLH)
Running Lifecycle Manager
NOTE
Lifecycle Manager will reboot the HLH multiple times during the upgrade process. You will need to log back into the HLH manually after each reboot; otherwise, the upgrade will not continue until you do.
As an optional step you can enable the Auto Logon feature on the HLH. This will allow the HLH to automatically log back in after each reboot.
To run Lifecycle Manager on the HLH, perform the following steps:
Steps
WARNING
Never use PowerShell ISE at any time during the use of this document.
From the HLH, open a PowerShell console window as an administrator.
You will need to export the BitLocker recovery keys before proceeding with the upgrade. Type the command below into your PowerShell prompt to export your BitLocker recovery keys.
You will be prompted to provide credentials for the following endpoints:
Hardware Lifecycle Host OS administrative account credential
iDRAC administrative account credential for the Hardware Lifecycle Host
You will then be prompted to confirm that you have backed up the BitLocker recovery keys. Press Y to confirm if you have backed up the BitLocker recovery keys; otherwise, press N to cancel the update process and back up your BitLocker recovery keys.
Once the update process begins, continue to monitor Lifecycle Manager while it runs. While the automation is running there will be multiple reboots, in order to keep the upgrade process progressing you must log back into the HLH manually; otherwise, the upgrade will not continue until you do.
Some updates are grouped together to limit the amount of reboots. The HLH may reboot for any of the following reasons:
Update Type
Reboot Type
Firmware updates
Separate reboot
Driver updates
Grouped reboot
Operating System updates
Grouped reboot
Windows Defender Application Control (WDAC) policy updates
Grouped reboot
Upon completion, the output should look similar to the image shown below. This shows a list of all completed tasks from Lifecycle Manager, as well as the total elapsed time of the upgrade.
If the upgrade was successful, you will see the Dell AzS Hub Lifecycle Manager completed successfully message in the output.
Finally, you can gather logs by navigating to the directory E:\LCM\Logs on the HLH. These logs can be used for troubleshooting purposes if needed.
Additionally, C:\MASLogs will contain logs related to the firmware update process.
Top-of-Rack (ToR) Switches
Manually Updating the Switch Firmware from the Hardware Lifecycle Host (HLH)
You must manually install the OS10 software image from the HLH using SCP and SSH commands.
WARNING
To maintain the integrity of Dell Azure Stack Hub Integrated System, it is required to perform the switch firmware update in conjunction with the Lifecycle Manager update process.
To update switch firmware, perform the following steps:
Steps
WARNING
Never use PowerShell ISE at any time during the use of this document.
From the HLH, open a PowerShell console window as an administrator.
The HLH can be accessed via Remote Desktop Protocol (RDP) from a Permitted Network.
Change directory to E:\OEM\AzS-Dell-<version>\Firmware\Switches\msftdell
Run the following command to copy the switch firmware from the extracted OEM package update zip file on the HLH to the ToR switches.
For example, if upgrading the firmware on ToR-1 with an IP address of 10.128.164.98 and a switch administrative user account of azsadmin-gtbzp, you would run the following:
For example, if upgrading the firmware on ToR-2 with an IP address of 10.128.164.99 and a switch administrative user account of azsadmin-gtbzp, you would run the following:
The below steps will be repeated on each ToR switch (e.g. ToR-1 and ToR-2) ONLY after fully completing the first switch (e.g. ToR-1).
Run the following commands to connect to the ToR switch.
For example, if upgrading the firmware on ToR-1 with an IP address of 10.128.164.98 and a switch administrative user account of azsadmin-gtbzp, you would run the following:
Enter the password of the switch administrative user account when prompted.
Run the following command to move the SCP copied firmware file to its intended destination (/var/os10-image):
system "sudo mv ./PKGS_OS10-Enterprise-<version>-installer-x86_64.bin /var/os10-image"
Enter the password of the switch administrative user account when prompted.
Verify the image is now located in the image directory.
dir image
The output should look similar to the below example:
Directory contents for folder:
Date (modified) Size (bytes) Name
--------------------- ------------ ------------------------------------------
2025-03-18T18:37:56+00:667040481 PKGS_OS10-Enterprise-<version>-installer-x86_64.bin
To verify that an installation is not already in progress, run the following command:
show image status
The output should look similar to the below example:
Image Upgrade State: idle
==================================================
File Transfer State: idle
--------------------------------------------------
State Detail: No download information available
Task Start: -001-11-30T00:00:00+00:00
Task End: -001-11-30T00:00:00+00:00
Transfer Progress: 0 %
Transfer Bytes: 0 bytes
File Size: 0 bytes
Transfer Rate: 0 kbps
Installation State: idle
--------------------------------------------------
State Detail: No install information available
Task Start: -001-11-30T00:00:00+00:00
Task End: -001-11-30T00:00:00+00:00
Run the following command to install the downloaded image to the standby partition:
To view the image install progress, run the following command:
show image status
The output should look similar to the below example:
Image Upgrade State: idle
==================================================
File Transfer State: idle
--------------------------------------------------
State Detail: No download information available
Task Start: 0000-00-00T00:00:00Z
Task End: 0000-00-00T00:00:00Z
Transfer Progress: 0 %
Transfer Bytes: 0 bytes
File Size: 0 bytes
Transfer Rate: 0 kbps
Installation State: install
--------------------------------------------------
State Detail: In progress: Configure filesystem (3 of 9)
Task Start: 2025-03-17T21:15:16Z
Task End: 0000-00-00T00:00:00Z
Keep checking until the image installation is complete. Then check to verify if the image is installed to the standby partition by running the following command:
show boot
The output should look similar to the below example:
Current system image information:
===================================
Type Boot Type Active Standby Next-Boot
-----------------------------------------------------------------------------------
Node-id 1 Flash Boot [B] 10.5.6.5 [A] 10.6.0.1 [B] active
Set the next boot partition to the standby partition where the downloaded image is installed by running the following command:
boot system standby
Save the currently running configuration and then reload to the configured image by running the following commands:
write memory
reload
After the switch reloads, copy the new active image to the standby boot partition by running the following command:
image copy active-to-standby
Verify the status of the BGP connections on the switches by running the following command:
show ip bgp summary
Verify that BGP is established for all neighbors as indicated by the Up/Down column showing a connection timer. The output should look similar to the below example:
Verify that the switch firmware version was updated by running the following command:
show version
The output should look similar to the below example:
Dell SmartFabric OS10 Enterprise
Copyright (c) 1999-2024 by Dell Inc. All Rights Reserved.
OS Version: 10.6.0.1
Build Version: 10.6.0.1.35
Build Time: 2024-12-02T17:55:39+0000
System Type: S5248F-ON
Architecture: x86_64
Up Time: 1 day 00:11:14
Original Equipment Manufacturer (OEM) package updates
Servicing Policy
Updates for the hardware components in the form of driver updates, firmware updates, and security patches are provided by Dell Technologies. These updates are referred to as OEM package updates. It is recommended to be within N-2 of the current available OEM package for Azure Stack Hub.
WARNING
Azure Stack Hub OEM package updates must be installed in sequential order.
It is not supported to skip an OEM package update version.
Identify the OEM version applied to the Azure Stack Hub
To identify the version of the Original Equipment Manufacturer (OEM) package currently applied to the Azure Stack Hub, perform the following steps:
Steps
Open the Azure Stack Hub administrator portal.
Open the Microsoft Azure Stack Hub - Administration Dashboard and click Dashboard.
Click Update.
The Updates blade will appear as shown below. The Updates blade displays your current Azure Stack Hub version and the latest deployed version of the OEM package update.
Import and Install an OEM package update
In this step you will be uploading and installing the OEM package update utilizing the Azure Stack Hub administrator portal.
CAUTION
Before you apply an OEM package update, always apply the latest Azure Stack Hub hotfix available for your Azure Stack Hub system.
For additional information about Azure Stack Hub updates, please see:
Access the Azure Stack Hub administrator portal of the system you wish to perform the OEM package update on.
Navigate to Storage accounts > updateadminaccount > Containers.
Create a container for the OEM package update by clicking +Container.
In the Name field on the right navigation pane enter the name for your container e.g. 2408oemupdate and then click Create.
Once the container is created, click the name of the container to access it.
Once you have clicked on the container click Upload at the top of the page.
Dell OEM package updates are in a zip format. The zip file contains the oemMetadata.xml file and the OEM package update payload.
You will need to upload both the zip file for the OEM package update and the oemMetadata.xml that is associated with it.
Once uploaded to the storage account container, they should appear in the container that was created in step 3.
Navigate back to the Dashboard and then click the Update tile.
The Updates blade should now show an available OEM package update that can be installed.
Click the update and then click Install to install the OEM package update.
After clicking install on the OEM package update, the update run details can be seen by clicking on the update in the Updates menu once the update has entered into a Preparing or Installing state.
Once completed, Updates blade should display Applied successfully and in the Update history menu the update state should be marked as Installed.
If the update fails, the Update blade reports Needs attention. Click on the failed update and use the Download summary button to get a high-level status of where the update failed.
6 - How To
6.1 - How to create a service principal name for Azure Stack Hub integrated with Active Directory Federation Services identity using PowerShell
Overview
This article explains how to create a service principal name (SPN) to manage Azure Stack Hub integrated with Active Directory Federation Services (AD FS) identity using PowerShell.
Overview of the creation process for Azure Stack Hub SPN
NOTE
The procedure provided is designed for Azure Stack Hub Operators as it requires Privileged Endpoint (PEP) access as well as assumes the Default Provider Subscription and the Administrator Azure Resource Manager endpoint as the defaults; however, the same mechanism can be applied to the User Subscriptions with minimal changes to the code.
If you want to assign a role the SPN for a User Subscription, replace the Administrator Azure Resource Manager endpoint with the Tenant Azure Resource Manager endpoint and the Default Provider Subscription with Subscription Name you want to modify.
Declare your variables accordingly.
Log in to your Azure Stack Hub Default Provider Subscription with administrator user credentials (needs to have the Owner role).
CAUTION
This requires interactive prompt as by default when using AD FS as your identity provider you cannot use user credentials in the non-interactive way.
This is the main reason why you would want to create an SPN so that you can automate your operations.
Create your AD FS application/service principal.
Assign the appropriate Role to your service principal.
NOTE
As a bonus, we include an example of how to assign the Owner role to an AD FS group
The current AzureStack modules do not support it natively, but this example will show you how to do it via API.
It is the preferred method of assigning roles, you should assign roles to a group rather than individual users.
Log in to your Azure Stack Hub Default Provider Subscription using the SPN account.
Verify SPN authentication and the role assignment.
Create Azure Stack Hub SPN
Create a PFX Certificate
#region Declare variables
$CertificateName = "ADFSAutomationCert"
$CertStore = "cert:\LocalMachine\My" # This can also be "cert:\CurrentUser\My" but in general service accounts cannot access CurrentUser cert store
$CertSubject = "CN=$CertificateName"
$PfxFilePath = "C:\Temp"
if (-not (Test-Path -Path $PfxFilePath)) {
New-Item -ItemType Directory -Path $PfxFilePath -Force | Out-Null
}
$PfxFilePathFull = Join-Path -Path $PfxFilePath -ChildPath "$($CertificateName).pfx"
$PfxPassword = '""' | ConvertTo-SecureString -AsPlainText -Force # replace "" with an actual password or leave "" for it to be blank
#endregion
#region Create certificate to pass into new Application
$ExpiryDate = (Get-Date).AddDays(365) # You can change this to whatever fits your security profile better, default is 1 year
$Cert = New-SelfSignedCertificate -CertStoreLocation $CertStore -Subject $CertSubject -KeySpec KeyExchange -NotAfter $ExpiryDate
Write-Verbose -Message "Certificate ""$($Cert.Subject)"" with start date ""$($Cert.NotBefore)"" and end date ""$($Cert.NotAfter)"" created at ""$($PfxFilePathFull)""."
#endregion
#region Get a cert object from a .pfx file - you need it to create the SPN to begin with
$Cert = Get-PfxCertificate -FilePath $PfxFilePathFull -Password $PfxPassword
#endregion
#region Optional steps
#region Export the certificate so that you can import it on other environments
try {
Export-PfxCertificate -Cert $Cert.PsPath -FilePath $PfxFilePathFull -Password $PfxPassword -ErrorAction Stop | Out-Null
} catch {
throw "Failed to export certificate to ""$($PfxFilePathFull)"":`n$($_.Exception.Message)"
}
#endregion
#region Import the certificate into the certificate store on another environment
Import-PfxCertificate -CertStoreLocation $CertStore -FilePath $PfxFilePathFull -Password $PfxPassword -Exportable
#endregion
#endregion
Create Azure Stack Hub SPN that uses certificate credential
#region Declare variables
$CertificateName = "ADFSAutomationCert"
$PfxFilePath = "C:\Temp"
$PfxFilePathFull = Join-Path -Path $PfxFilePath -ChildPath "$($CertificateName).pfx"
$PfxPassword = '""' | ConvertTo-SecureString -AsPlainText -Force
$CertificateObject = Get-PfxCertificate -FilePath $PfxFilePathFull -Password $PfxPassword
$CertificateThumbprint = $CertificateObject.Thumbprint
if (!$CertificateThumbprint) {
throw "Failed to obtain a thumbprint from certificate: $($PfxFilePathFull)"
}
$CloudAdminUsername = "CloudAdmin@azurestack.local"
[SecureString]$CloudAdminPassword = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$ApplicationName = "ADFSAppCert"
$AzureStackRole = "Owner"
$ADGroupName = "AzureStackHubOwners"
$AzureStackAdminArmEndpoint = "https://adminmanagement.local.azurestack.external/"
$EnvironmentName = "AzureStackAdmin"
$PepCreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $CloudAdminUsername, $CloudAdminPassword
$PepIPAddress = "x.x.x.224" # e.g. 10.5.30.224
#endregion
#region Register and set an Az environment that targets your Azure Stack Hub instance
Write-Output -InputObject "Connecting to Azure Stack Hub Admin Management Endpoint - $(AzureStackAdminArmEndpoint)"
$null = Add-AzEnvironment -Name $EnvironmentName -ARMEndpoint $AzureStackAdminArmEndpoint
$null = Connect-AzAccount -Environment $EnvironmentName -UseDeviceAuthentication # Interactive prompt
if (((Get-AzContext).Subscription).Name -notlike "Default Provider Subscription") {
throw "Failed to obtain access to the 'Default Provider Subscription'. Please verify the user has been assigned the '$($AzureStackRole)' role for the 'Default Provider Subscription'."
}
#endregion
#region Create a PSSession to the Privileged Endpoint VM
Write-Output -InputObject "Create a PowerShell Session to the Privileged Endpoint VM"
$PepSession = New-PSSession -ComputerName $PepIPAddress -ConfigurationName PrivilegedEndpoint -Credential $PepCreds -SessionOption (New-PSSessionOption -Culture en-US -UICulture en-US)
#endregion
#region Check for existing SPN
Write-Output -InputObject "Check for existing SPN '$($ApplicationName)'"
$SPNObjectCheckJob = Invoke-Command -Session $PepSession -ScriptBlock { Get-GraphApplication } -AsJob | Wait-Job
if ($SPNObjectCheckJob.State -ne "Completed") {
throw "$($SPNObjectCheckJob.ChildJobs | Receive-Job)"
}
$SPNObjectCheck = $SPNObjectCheckJob.ChildJobs.Output | Where-Object { $_.Name -like "Azurestack-$ApplicationName*" } | Select-Object -Last 1
#endregion
#region Create new SPN if one does not exist
if ($SPNObjectCheck) {
Write-Output -InputObject "SPN details`n$($ApplicationName): $($SPNObjectCheck | Out-String)"
} else {
Write-Output -InputObject "No existing SPN found"
Write-Output -InputObject "Create new SPN '$($ApplicationName)'"
$SPNObjectJob = Invoke-Command -Session $PepSession -ScriptBlock { New-GraphApplication -Name $using:ApplicationName -ClientCertificates $using:CertificateObject } -AsJob | Wait-Job
if ($SPNObjectJob.State -ne "Completed") {
throw "$($SPNObjectJob.ChildJobs | Receive-Job)"
}
$SPNObject = $SPNObjectJob.ChildJobs.Output
Write-Output -InputObject "SPN details`n$($ApplicationName): $($SPNObject | Out-String)"
$FullApplicationName = $SPNObject.ApplicationName
#endregion
}
#region Assign SPN the 'Owner' role for the 'Default Provider Subscription'
Write-Output -InputObject "Assign SPN '$($ApplicationName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
if ($FullApplicationName) {
$SPNADFSApp = Get-AzADServicePrincipal | Where-Object { $_.DisplayName -like "$($FullApplicationName)" }
} else {
$SPNADFSApp = Get-AzADServicePrincipal | Where-Object { $_.DisplayName -like "*$($ApplicationName)*" } | Select-Object -Last 1
}
$SPNRoleAssignmentCheck = Get-AzRoleAssignment -ObjectId $SPNADFSApp.AdfsId
if (!($SPNRoleAssignmentCheck) -or ($SPNRoleAssignmentCheck.RoleDefinitionName -ne $AzureStackRole)) {
$null = New-AzRoleAssignment -RoleDefinitionName $AzureStackRole -ServicePrincipalName $SPNADFSApp.ApplicationId.Guid
#region Verify SPN has been assigned the 'Owner' role for the 'Default Provider Subscription'
$SPNRoleAssignment = Get-AzRoleAssignment -ObjectId $SPNADFSApp.AdfsId
if (!($SPNRoleAssignment) -or ($SPNRoleAssignment.RoleDefinitionName -ne $AzureStackRole)) {
throw "Failed to assign SPN '$($ApplicationName)' the '$($AzureStackRole)' role for the Default Provider Subscription"
}
#endregion
}
#endregion
#region Assign AD group 'AzureStackOwners' the 'Owner' role for the 'Default Provider Subscription'
Write-Output -InputObject "Assign AD group '$($ADGroupName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
$ADGroup = Get-AzADGroup -DisplayNameStartsWith $ADGroupName
$SubId = (Get-AzSubscription -SubscriptionName "Default Provider Subscription").Id
$OwnerRoleId = (Get-AzRoleDefinition -Name $AzureStackRole).Id
$APIPayloadHash = @{
"properties" = @{
"roleDefinitionId" = "/subscriptions/$($SubId)/providers/Microsoft.Authorization/roleDefinitions/$($OwnerRoleId)"
"principalId" = "$($ADGroup.AdfsId)"
}
} | ConvertTo-Json -Depth 50
$APIPath = "/subscriptions/$($SubId)/providers/Microsoft.Authorization/roleAssignments/$($OwnerRoleId)?api-version=2015-07-01"
$APIResponse = Invoke-AzRestMethod -Path $APIPath -Method "PUT" -Payload $APIPayloadHash
if ($APIResponse.StatusCode -ne "201") {
throw "Failed to create role assignment for ""$($ADGroup.DisplayName)"" in subscription ""$($SubId)"" with role ""$($AzureStackRole)"" and role ID ""$($OwnerRoleId)"""
}
#endregion
#region Verify AD group 'AzureStackOwners' has been assigned the 'Owner' role for the 'Default Provider Subscription'
$ADGroupRoleAssignment = Get-AzRoleAssignment -ObjectId $ADGroup.AdfsId
if (!($ADGroupRoleAssignment) -or ($ADGroupRoleAssignment.RoleDefinitionName -ne $AzureStackRole)) {
throw "Failed to assign AD group '$($ADGroupName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
}
#endregion
#region Obtain authentication information
# GUID of the directory tenant
$TenantId = (Get-AzContext).Tenant.Id
Write-Output -InputObject "TenantId: $($TenantId)"
Write-Output -InputObject ""
Write-Output -InputObject "ApplicationName: $($SPNADFSApp.DisplayName)"
Write-Output -InputObject ""
Write-Output -InputObject "ApplicationId: $($SPNADFSApp.ApplicationId.Guid)"
Write-Output -InputObject ""
Write-Output -InputObject "CertificateThumbprint: $($CertificateThumbprint)"
Write-Output -InputObject ""
Write-Output -InputObject "Admin ARM Endpoint: $($AzureStackAdminArmEndpoint)"
#endregion
#region Verify if SPN can authenticate to Azure Stack Hub Admin Management Endpoint
Write-Output -InputObject "Verify if SPN can authenticate to Azure Stack Hub Admin Management Endpoint"
$null = Clear-AzContext -Force
$null = Connect-AzAccount -Environment $EnvironmentName -ServicePrincipal -Tenant $TenantId -ApplicationId $SPNADFSApp.ApplicationId.Guid -CertificateThumbprint $CertificateThumbprint
if (((Get-AzContext).Subscription).Name -notlike "Default Provider Subscription") {
throw "Failed to obtain access to the 'Default Provider Subscription'. Please verify the SPN has been assigned the '$($AzureStackRole)' role for the 'Default Provider Subscription'."
} else {
Write-Output -InputObject "Your SPN can successfully authenticate with ARM Endpoint $($AzureStackAdminArmEndpoint) and has got access to the 'Default Provider Subscription'"
}
#endregion
#region Remove sessions
if ($PepSession) {
Write-Output -InputObject "Removing PSSSession to the Privileged Endpoint"
Remove-PSSession -Session $PepSession
}
$CheckContext = Get-AzContext | Where-Object { $_.Environment -like $EnvironmentName }
if ($CheckContext) {
Write-Output -InputObject "Disconnecting from AzS Hub Admin Management Endpoint: $($CheckContext.Environment.ResourceManagerUrl)"
$null = Disconnect-AzAccount
}
#endregion
CAUTION
Using a client secret is less secure than using an X509 certificate credential. Not only is the authentication mechanism less secure, but it also typically requires embedding the secret in the client app source code. As such, for production apps, you’re strongly encouraged to use a certificate credential.
#region Declare variables
$CloudAdminUsername = "CloudAdmin@azurestack.local"
[SecureString]$CloudAdminPassword = ConvertTo-SecureString "Password123!" -AsPlainText -Force
$ApplicationName = "ADFSAppCert"
$AzureStackRole = "Owner"
$ADGroupName = "AzureStackHubOwners"
$AzureStackAdminArmEndpoint = "https://adminmanagement.local.azurestack.external/"
$EnvironmentName = "AzureStackAdmin"
$PepCreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $CloudAdminUsername, $CloudAdminPassword
$PepIPAddress = "x.x.x.224" # e.g. 10.5.30.224
#endregion
#region Register and set an Az environment that targets your Azure Stack Hub instance
Write-Output -InputObject "Connecting to Azure Stack Hub Admin Management Endpoint - $(AzureStackAdminArmEndpoint)"
$null = Add-AzEnvironment -Name $EnvironmentName -ARMEndpoint $AzureStackAdminArmEndpoint
$null = Connect-AzAccount -Environment $EnvironmentName -UseDeviceAuthentication # Interactive prompt
if (((Get-AzContext).Subscription).Name -notlike "Default Provider Subscription") {
throw "Failed to obtain access to the 'Default Provider Subscription'. Please verify the user has been assigned the '$($AzureStackRole)' role for the 'Default Provider Subscription'."
}
#endregion
#region Create a PSSession to the Privileged Endpoint VM
Write-Output -InputObject "Create a PowerShell Session to the Privileged Endpoint VM"
$PepSession = New-PSSession -ComputerName $PepIPAddress -ConfigurationName PrivilegedEndpoint -Credential $PepCreds -SessionOption (New-PSSessionOption -Culture en-US -UICulture en-US)
#endregion
#region Check for existing SPN
Write-Output -InputObject "Check for existing SPN '$($ApplicationName)'"
$SPNObjectCheckJob = Invoke-Command -Session $PepSession -ScriptBlock { Get-GraphApplication } -AsJob | Wait-Job
if ($SPNObjectCheckJob.State -ne "Completed") {
throw "$($SPNObjectCheckJob.ChildJobs | Receive-Job)"
}
$SPNObjectCheck = $SPNObjectCheckJob.ChildJobs.Output | Where-Object { $_.Name -like "Azurestack-$ApplicationName*" } | Select-Object -Last 1
#endregion
#region Create new SPN if one does not exist
if ($SPNObjectCheck) {
Write-Output -InputObject "SPN details`n$($ApplicationName): $($SPNObjectCheck | Out-String)"
} else {
Write-Output -InputObject "No existing SPN found"
Write-Output -InputObject "Create new SPN '$($ApplicationName)'"
$SPNObjectJob = Invoke-Command -Session $PepSession -ScriptBlock { New-GraphApplication -Name $using:ApplicationName -GenerateClientSecret } -AsJob | Wait-Job
if ($SPNObjectJob.State -ne "Completed") {
throw "$($SPNObjectJob.ChildJobs | Receive-Job)"
}
$SPNObject = $SPNObjectJob.ChildJobs.Output
Write-Output -InputObject "SPN details`n$($ApplicationName): $($SPNObject | Out-String)"
$FullApplicationName = $SPNObject.ApplicationName
$SPNClientId = $SPNObject.ClientId
$SPNClientSecret = $SPNObject.ClientSecret | ConvertTo-SecureString -AsPlainText -Force
$SPNCreds = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $SPNClientId, $SPNClientSecret
#endregion
}
#region Assign SPN the 'Owner' role for the 'Default Provider Subscription'
Write-Output -InputObject "Assign SPN '$($ApplicationName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
if ($FullApplicationName) {
$SPNADFSApp = Get-AzADServicePrincipal | Where-Object { $_.DisplayName -like "$($FullApplicationName)" }
} else {
$SPNADFSApp = Get-AzADServicePrincipal | Where-Object { $_.DisplayName -like "*$($ApplicationName)*" } | Select-Object -Last 1
}
$SPNRoleAssignmentCheck = Get-AzRoleAssignment -ObjectId $SPNADFSApp.AdfsId
if (!($SPNRoleAssignmentCheck) -or ($SPNRoleAssignmentCheck.RoleDefinitionName -ne $AzureStackRole)) {
$null = New-AzRoleAssignment -RoleDefinitionName $AzureStackRole -ServicePrincipalName $SPNADFSApp.ApplicationId.Guid
#region Verify SPN has been assigned the 'Owner' role for the 'Default Provider Subscription'
$SPNRoleAssignment = Get-AzRoleAssignment -ObjectId $SPNADFSApp.AdfsId
if (!($SPNRoleAssignment) -or ($SPNRoleAssignment.RoleDefinitionName -ne $AzureStackRole)) {
throw "Failed to assign SPN '$($ApplicationName)' the '$($AzureStackRole)' role for the Default Provider Subscription"
}
#endregion
}
#endregion
#region Assign AD group 'AzureStackOwners' the 'Owner' role for the 'Default Provider Subscription'
Write-Output -InputObject "Assign AD group '$($ADGroupName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
$ADGroup = Get-AzADGroup -DisplayNameStartsWith $ADGroupName
$SubId = (Get-AzSubscription -SubscriptionName "Default Provider Subscription").Id
$OwnerRoleId = (Get-AzRoleDefinition -Name $AzureStackRole).Id
$APIPayloadHash = @{
"properties" = @{
"roleDefinitionId" = "/subscriptions/$($SubId)/providers/Microsoft.Authorization/roleDefinitions/$($OwnerRoleId)"
"principalId" = "$($ADGroup.AdfsId)"
}
} | ConvertTo-Json -Depth 50
$APIPath = "/subscriptions/$($SubId)/providers/Microsoft.Authorization/roleAssignments/$($OwnerRoleId)?api-version=2015-07-01"
$APIResponse = Invoke-AzRestMethod -Path $APIPath -Method "PUT" -Payload $APIPayloadHash
if ($APIResponse.StatusCode -ne "201") {
throw "Failed to create role assignment for ""$($ADGroup.DisplayName)"" in subscription ""$($SubId)"" with role ""$($AzureStackRole)"" and role ID ""$($OwnerRoleId)"""
}
#endregion
#region Verify AD group 'AzureStackOwners' has been assigned the 'Owner' role for the 'Default Provider Subscription'
$ADGroupRoleAssignment = Get-AzRoleAssignment -ObjectId $ADGroup.AdfsId
if (!($ADGroupRoleAssignment) -or ($ADGroupRoleAssignment.RoleDefinitionName -ne $AzureStackRole)) {
throw "Failed to assign AD group '$($ADGroupName)' the '$($AzureStackRole)' role for the 'Default Provider Subscription'"
}
#endregion
#region Obtain authentication information
# GUID of the directory tenant
$TenantId = (Get-AzContext).Tenant.Id
Write-Output -InputObject "TenantId: $($TenantId)"
Write-Output -InputObject ""
Write-Output -InputObject "ApplicationName: $($SPNADFSApp.DisplayName)"
Write-Output -InputObject ""
Write-Output -InputObject "ApplicationId: $($SPNADFSApp.ApplicationId.Guid)"
Write-Output -InputObject ""
Write-Output -InputObject "ClientSecret: $($SPNObject.ClientSecret)"
Write-Output -InputObject ""
Write-Output -InputObject "Admin ARM Endpoint: $($AzureStackAdminArmEndpoint)"
#endregion
#region Verify if SPN can authenticate to Azure Stack Hub Admin Management Endpoint
Write-Output -InputObject "Verify if SPN can authenticate to Azure Stack Hub Admin Management Endpoint"
$null = Clear-AzContext -Force
$null = Connect-AzAccount -Environment $EnvironmentName -ServicePrincipal -Tenant $TenantId -Credential $SPNCreds
if (((Get-AzContext).Subscription).Name -notlike "Default Provider Subscription") {
throw "Failed to obtain access to the 'Default Provider Subscription'. Please verify the SPN has been assigned the '$($AzureStackRole)' role for the 'Default Provider Subscription'."
} else {
Write-Output -InputObject "Your SPN can successfully authenticate with ARM Endpoint $($AzureStackAdminArmEndpoint) and has got access to the 'Default Provider Subscription'"
}
#endregion
#region Remove sessions
if ($PepSession) {
Write-Output -InputObject "Removing PSSSession to the Privileged Endpoint"
Remove-PSSession -Session $PepSession
}
$CheckContext = Get-AzContext | Where-Object { $_.Environment -like $EnvironmentName }
if ($CheckContext) {
Write-Output -InputObject "Disconnecting from AzS Hub Admin Management Endpoint: $($CheckContext.Environment.ResourceManagerUrl)"
$null = Disconnect-AzAccount
}
#endregion