AzL Sonar — research (S-1, S-2, S-3)
Research for plan tasks S-1, S-2 and S-3 (plan), checked against the contract in design. Written 10 Oct 2026.
Rules used. Microsoft Learn is the only source. Azure Local pages are read at view=azloc-2609. Every row cites the Learn page it comes from. When Learn does not state something, the row says Not on Learn and the item stays unverified until a live test confirms it. The Verified live 10 Oct 2026 column is left empty for the owner to fill in from a live test of a clus01 cluster.
0. What this changes in the design
These are the findings that conflict with design.md or add a risk to it. Each one is explained further down.
| # | Finding | Effect on the design | Source |
|---|---|---|---|
| D1 | Learn's template reference lists Microsoft.AzureStackHCI/edgeMachines and edgeMachines/jobs only from 2025-12-01-preview onward (2025-12-01-preview, 2026-02-15-preview, 2026-03-01-preview, 2026-04-01-preview, 2026-05-01-preview, 2026-10-01, 2026-10-15-preview). There is no 2025-09-15-preview page. Microsoft's own retry script for OS provisioning calls edgeMachines with api-version=2025-12-01-preview. | Poller step 3 (edgeMachines?api-version=2025-09-15-preview) will probably be rejected. Use a separate edge-machine api-version, defaulting to 2025-12-01-preview. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/edgemachines ; https://learn.microsoft.com/azure/azure-local/deploy/troubleshoot-simplified-machine-provisioning?view=azloc-2609 |
| D2 | Learn documents only three step status values: 'Error', 'Success', 'InProgress'. EceActionStatus.status is an untyped string with no list of values. | NotStarted/Not Started, Failed and Skipped in the design come from what a live test saw, not from Learn. Keep the normaliser tolerant and send any unknown value to notstarted, never to error. | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/deploymentstep?view=azure-node-preview |
| D3 | Learn has no REST page for the read-only reportedProperties at 2025-09-15-preview. The Learn REST reference shows api-version 2024-04-01, and the template reference leaves out read-only properties. The newest preview SDK models have the same shape as 2024-04-01. | Low risk, but the 2025-09-15-preview shape is only inferred. Confirm it in a live test. | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get ; https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-09-15-preview/clusters/deploymentsettings |
| D4 | The edge machine lifecycle seen in a live test (Creating → AwaitingConnection → Provisioning → ReadyForOs → InstallingOs → Provisioned) does not appear on Learn. Learn's machineState enum is different: Created, Preparing, Registering, Transitioning, Purposed, Unpurposed, Resetting, Updating, Failed. provisioningState uses the generic HCI enum. | Read machineState, provisioningState and the ProvisionOs job together, and treat any value as a free string. Find out in a live test which field held the live values. | https://learn.microsoft.com/dotnet/api/azure.resourcemanager.hci.models.edgemachinestate?view=azure-dotnet-preview |
| D5 | Learn does not name the deployment log files under C:\CloudDeployment\Logs. It names only the Environment Checker log and report written there during deployment, and the upgrade logs (FullCloudUpgrade.*.log, and C:\MASLogs\LcmEceLiteLogs\InvokeCloudUpgradeEnvironmentChecker.*.log). | The default logs.paths is reasonable, but Learn does not guarantee the file names or the rotation. Tail by folder, which the design already does. | https://learn.microsoft.com/azure/azure-local/manage/use-environment-checker?view=azloc-2609 ; https://learn.microsoft.com/azure/azure-local/upgrade/troubleshoot-upgrade-to-23h2?view=azloc-2609 |
| D6 | Learn does not state the file permissions on C:\CloudDeployment\Logs or C:\MASLogs. "Members of local Administrators can read them" is inferred, not documented. | Every row about which account can read the logs is unverified until a live test confirms it. | — |
| D7 | After deployment, the built-in Administrator (RID 500) is renamed ASBuiltInAdmin and RDP is turned off. | If the credential uses the built-in Administrator name, it stops working once deployment finishes. Sonar must say so in its guidance. | https://learn.microsoft.com/azure/azure-local/concepts/security-features?view=azloc-2609#local-built-in-user-accounts ; https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal?view=azloc-2609#post-deployment-tasks |
| D8 | An Arc run command is an Azure write: a PUT .../machines/{m}/runCommands/{name} that needs Microsoft.HybridCompute/machines/runCommands/write. Arc SSH can also PUT the HybridConnectivity endpoint and its service configuration. | Using either one breaks design goal 5 ("never changes Azure"). Keep both off by default and only turn them on when the user explicitly opts in. | https://learn.microsoft.com/azure/azure-arc/servers/run-command ; https://learn.microsoft.com/azure/azure-arc/servers/ssh-arc-overview |
| D9 | When the workstation is in a workgroup, or connects by IP address, WinRM uses NTLM and needs the target in TrustedHosts or HTTPS. For a local account that isn't the built-in Administrator, a Windows Admin Center page says LocalAccountTokenFilterPolicy=1 may be needed on the target. Learn says nothing about whether Azure Local sets it. | Local Identity nodes, and AD nodes before they're joined to the domain, can refuse remoting with the deployment local admin even when TrustedHosts is correct. Sonar should report "access denied" separately from "TrustedHosts". | https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_remote_troubleshooting?view=powershell-7.6 ; https://learn.microsoft.com/windows-server/manage/windows-admin-center/support/troubleshooting#using-windows-admin-center-in-a-workgroup |
S-1 — The deploymentSettings step tree
Resource, nesting and fields
| Fact | Detail | Source | Verified live 10 Oct 2026 |
|---|---|---|---|
| Resource and GET | GET /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.AzureStackHCI/clusters/{cluster}/deploymentSettings/{name}. Name pattern ^[a-zA-Z0-9-]{3,24}$. Learn's example uses the name default. | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get | |
| Api-versions | Learn's template reference lists deploymentSettings versions from 2023-08-01-preview to 2026-10-15-preview, 2025-09-15-preview included. The page shows writable properties only. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-09-15-preview/clusters/deploymentsettings | |
| Top-level properties | properties.arcNodeResourceIds, deploymentConfiguration, deploymentMode, operationType, provisioningState, reportedProperties (plus systemData). | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get | |
reportedProperties (EceReportedProperties) | { validationStatus: EceActionStatus, deploymentStatus: EceActionStatus }. | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/ecereportedproperties?view=azure-node-latest | |
| EceActionStatus | { status: string, steps: DeploymentStep[] }. Learn gives no list of status values (Not on Learn). | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get | |
| DeploymentStep | name, description, fullStepIndex (string), startTimeUtc (string), endTimeUtc (string), status (string), exception (string[]), steps (DeploymentStep[], nested). | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/deploymentstep?view=azure-node-preview | |
| Step status values | "Allowed values are 'Error', 'Success', 'InProgress'". NotStarted, Skipped and Failed are Not on Learn (live test only). | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/deploymentstep?view=azure-node-preview | |
| Timestamps | Strings named ...Utc. Learn gives no format. ISO 8601 is assumed (Not on Learn). | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/deploymentstep?view=azure-node-preview | |
Empty status object {} before a run starts | Not on Learn. All fields are optional, so the object can be empty. | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/ecereportedproperties?view=azure-node-latest | |
provisioningState values | Succeeded, Failed, Canceled, NotSpecified, Provisioning, Updating, Deleting, Accepted (REST 2024-04-01). | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get | |
deploymentMode values | Validate, Deploy (default Deploy). Validate "creates Azure resources for this system and validates your system's readiness to deploy". Deploy "performs the actual deployment after successful validation". | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-09-15-preview/clusters/deploymentsettings ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609 | |
operationType values | ClusterProvisioning, ClusterUpgrade (default ClusterProvisioning). | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-09-15-preview/clusters/deploymentsettings | |
| Secret names (context) | AzureStackLCMUserCredential, LocalAdminCredential, DefaultARBApplication, WitnessStorageKey. | https://learn.microsoft.com/rest/api/stackhci/deployment-settings/get | |
How often reportedProperties refreshes | Not on Learn. The portal says to select Refresh to see the latest status. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609#step-2-deploy-using-arm-template |
How the portal's progress view maps to the resource
| Portal behaviour | Detail | Source | Verified live 10 Oct 2026 |
|---|---|---|---|
| Validation tab | Validation takes about 15 minutes for 1–2 machines in the portal wizard (and for the rack aware template: longer for bigger deployments). "Don't select Try again while validation tasks are running". The ARM template flows (Active Directory, Local Identity with Key Vault, disaggregated) say about 10 minutes. | https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal?view=azloc-2609 | |
| Deployments page | After Create, the cluster's Deployments page shows progress. Watch it from the seed machine. The task at the top shows status and end time when it finishes. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609#step-2-deploy-using-arm-template | |
| What runs first in Deploy mode | "a limited Environment Checker run, a full Environment Checker run, and cloud deployment starts". | https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault-template?view=azloc-2609 | |
| Durations | Begin cloud deployment takes 45–60 minutes. One machine takes about 1.5–2 hours in total; two nodes take about 2.5 hours. The longest step is Deploy Moc and ARB Stack (40–45 minutes). | https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal?view=azloc-2609#validate-and-deploy-the-system ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609 | |
| Resume | Deployments → Resume deployment reruns a failed deployment. | https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal?view=azloc-2609#resume-deployment | |
Mapping of portal rows to reportedProperties.*.steps | That the portal rows are drawn from validationStatus/deploymentStatus steps is Not on Learn. It is an inference from the shared field names. | — |
Edge machines (simplified machine provisioning)
| Fact | Detail | Source | Verified live 10 Oct 2026 |
|---|---|---|---|
| Resource type | Microsoft.AzureStackHCI/edgeMachines. ARM calls it "Edge Machine" and the portal and CLI call it "Provisioned Machine". | https://learn.microsoft.com/azure/azure-local/small-form-factor/small-form-factor-resource-overview?view=azloc-2609#provisioned-machine | |
| Api-versions | 2025-12-01-preview, 2026-02-15-preview, 2026-03-01-preview, 2026-04-01-preview, 2026-05-01-preview, 2026-10-01, 2026-10-15-preview. No 2025-09-15-preview (see D1). | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/edgemachines | |
| Read-only state properties | provisioningState, machineState, connectivityStatus, operationDetails, reportedProperties, lastSyncedOn, arcMachineResourceId, claimedBy, cloudId, siteDetails, provisioningDetails. | https://learn.microsoft.com/dotnet/api/azure.resourcemanager.hci.models.edgemachineproperties?view=azure-dotnet-preview | |
machineState values | Created, Preparing, Registering, Transitioning, Purposed, Unpurposed, Resetting, Updating, Failed. Failed means the only way to recover is to provision the machine again. | https://learn.microsoft.com/dotnet/api/azure.resourcemanager.hci.models.edgemachinestate?view=azure-dotnet-preview | |
provisioningState values (shared HCI enum) | Accepted, Canceled, Connected, Creating, Deleted, Deleting, DisableInProgress, Disconnected, Error, Failed, InProgress, Moving, NotSpecified, PartiallyConnected, PartiallySucceeded, Provisioning, Succeeded, Updating. | https://learn.microsoft.com/dotnet/api/azure.resourcemanager.hci.models.hciprovisioningstate?view=azure-dotnet-preview | |
| Jobs | Microsoft.AzureStackHCI/edgeMachines/jobs. jobType is CollectLog, DownloadOs, ProvisionOs or RemoteSupport. Learn's retry script uses the job name ProvisionOs. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-12-01-preview/edgemachines/jobs ; https://learn.microsoft.com/azure/azure-local/deploy/troubleshoot-simplified-machine-provisioning?view=azloc-2609 | |
| Job properties | jobId, jobType, deploymentMode, provisioningState, status, startTimeUtc, endTimeUtc, error (ErrorDetail). | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/edgemachinejobproperties?view=azure-node-preview | |
| ProvisionOs/DownloadOs reportedProperties | percentComplete, validationStatus (EceActionStatus), deploymentStatus (EceActionStatus). These have the same step-tree shape as deploymentSettings, so ConvertTo-AzlSonarStepTree can be reused. | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/provisionosreportedproperties?view=azure-node-preview | |
Job status values | NotSpecified, ValidationInProgress, ValidationSuccess, ValidationFailed, DeploymentInProgress, DeploymentFailed, DeploymentSuccess, Succeeded, Failed, Canceled, Paused, Scheduled. | https://learn.microsoft.com/javascript/api/@azure/arm-azurestackhci/knownjobstatus?view=azure-node-latest | |
| Portal status | Azure Arc → Operations → Provisioning (preview) → Provisioned machines. Wait for Ready to cluster. | https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#step-5-verify-azure-arc-connectivity | |
| Arc resource name | The portal asks you to "Provide the machine name as the Azure Arc resource name". A live test saw device-ID names (plan inputs), so keep arcMachineName mapping configurable. | https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#step-3-provision-machines-from-azure | |
| Preview limits | Only East US supports provisioning resources. The Arc gateway isn't supported. There is no automatic retry if OS install fails; the retry PUTs jobs/ProvisionOs and takes up to 30 minutes. | https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#prerequisites ; https://learn.microsoft.com/azure/azure-local/deploy/troubleshoot-simplified-machine-provisioning?view=azloc-2609 | |
Observed lifecycle names (AwaitingConnection, ReadyForOs, InstallingOs, ...) and ProvisionOs sub-steps (Initialize, DownloadOs, PrepareOs, RebootOs, InstallExtensions, Finalize) | Not on Learn. | — |
S-2 — Where the logs are, when they exist, and how to collect them
Log locations by phase
| Phase | Path (node) | Files | When it exists | Source | Verified live 10 Oct 2026 |
|---|---|---|---|---|---|
| Provisioning (bootstrap, Configurator app, simplified provisioning) | C:\Windows\System32\Bootstrap\Logs | Learn names no files | During and after bootstrap/Arc registration on the Azure Stack HCI OS. Learn says to reach it over RDP (Configurator page) or PowerShell (provisioning page). | https://learn.microsoft.com/azure/azure-local/manage/troubleshoot-deployment-configurator-app?view=azloc-2609 ; https://learn.microsoft.com/azure/azure-local/deploy/troubleshoot-simplified-machine-provisioning?view=azloc-2609 | |
| Provisioning (maintenance environment, before OS) | /var/log/bootstrap, /var/log/provisioningextension, /var/log/trident-full.log, /var/log/messages, /var/log/bootstraprestservice | as listed | While the machine runs the Linux maintenance environment. Learn's route in is the Configurator app support package (default user edgeuser). | https://learn.microsoft.com/azure/azure-local/deploy/troubleshoot-simplified-machine-provisioning?view=azloc-2609 ; https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#step-2-prepare-machines | |
| Provisioning / all phases (Arc agent) | %ProgramData%\AzureConnectedMachineAgent\Log | himds.log (heartbeat, identity), azcmagent.log (azcmagent commands) | From Arc agent install onward. The folder stays even after the agent is removed. | https://learn.microsoft.com/azure/azure-arc/servers/agent-overview#agent-resources | |
| Provisioning / all phases (extensions) | %ProgramData%\GuestConfig\ext_mgr_logs\gc_ext.log; %ProgramData%\GuestConfig\extension_logs\*; %ProgramData%\GuestConfig\arc_policy_logs\gc_agent.log | as listed | From Arc agent install onward. Shows installs of the mandatory extensions (for example LCM, Device Management). | https://learn.microsoft.com/azure/azure-arc/servers/security-data-privacy#local-logs | |
| Provisioning (Arc registration script) | Learn gives no path. Learn offers Get-ArcBootstrapStatus and Collect-ArcBootstrapSupportLogs. | — | After Invoke-AzStackHciArcInitialization. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-without-azure-arc-gateway?view=azloc-2609#step-3-run-registration-script | |
| Validation (standalone Environment Checker) | $HOME\.AzStackHci\ | AzStackHciEnvironmentChecker.log, AzStackHciEnvironmentReport.json. Each run overwrites them. | When you run the checker by hand (it contains personal data). | https://learn.microsoft.com/azure/azure-local/manage/use-environment-checker?view=azloc-2609#run-readiness-checks | |
| Validation (Environment Checker inside a deployment) | C:\CloudDeployment\Logs | Learn gives the folder only. "Each run of the validator overwrites the existing file." | When validation runs as part of deployment (Validate mode, then the limited and full checker runs at the start of Deploy). | https://learn.microsoft.com/azure/azure-local/manage/use-environment-checker?view=azloc-2609#run-readiness-checks | |
| Deployment (cloud deployment, ECE/LCM) | C:\CloudDeployment\Logs (seed node) | Not on Learn for deployment. The upgrade equivalent is FullCloudUpgrade.<date>.<time>.log. | During and after cloud deployment. Sample output on Learn shows the prompt PS C:\CloudDeployment\logs> on a deployed node. | https://learn.microsoft.com/azure/azure-local/upgrade/troubleshoot-upgrade-to-23h2?view=azloc-2609#solution-upgrade ; https://learn.microsoft.com/azure/azure-local/manage/collect-logs?view=azloc-2609 | |
| Deployment / validation (LCM ECE lite) | C:\MASLogs\LcmEceLiteLogs | Upgrade only: InvokeCloudUpgradeEnvironmentChecker.<date>.<time>.log. That a deployment writes here is Not on Learn. | Not on Learn for deployment. | https://learn.microsoft.com/azure/azure-local/upgrade/troubleshoot-upgrade-to-23h2?view=azloc-2609#solution-upgrade | |
| Other nodes (not seed) | Not on Learn. Learn only says to watch progress "from the first machine (also known as the seed machine)". | — | — | https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609#step-2-deploy-using-arm-template | |
| Post-deployment | Same folders. Learn adds on-demand collection through the observability extension (below). | — | After deployment, once AzureEdgeTelemetryAndDiagnostics is installed. | https://learn.microsoft.com/azure/azure-local/manage/collect-logs?view=azloc-2609#prerequisites | |
Log rotation and naming inside C:\CloudDeployment\Logs | Not on Learn. | — | — | — |
How Microsoft says to collect logs
| Method | When to use | Key facts | Source | Verified live 10 Oct 2026 |
|---|---|---|---|---|
Standalone log collection: Send-AzStackHciDiagnosticData | Deployment failures, registration failures, observability not deployed, system not registered | Copy the requested data off the node to a machine that can reach Azure, then send it with -DiagnosticLogPath. Authenticate with device code, an SPN, or the existing Az context. File a support ticket first. | https://learn.microsoft.com/azure/azure-local/manage/get-support-for-deployment-issues?view=azloc-2609#perform-standalone-log-collection ; https://learn.microsoft.com/azure/azure-local/concepts/observability?view=azloc-2609#diagnostics | |
On-demand collection: Send-DiagnosticData | Registered and connected system with observability installed, including partially registered systems | Run it on any node. With no parameters it collects the last hour from all nodes. You can filter with -FilterByRole (includes DeploymentLogs, ECE, ArcAgent, BareMetal, ALM). -SaveToPath keeps logs local instead of sending them. A collection can't exceed 24 hours, and only one runs at a time. Get-LogCollectionHistory shows past runs. Needs the Azure Stack HCI Administrator role and the AzureEdgeTelemetryAndDiagnostics extension. | https://learn.microsoft.com/azure/azure-local/manage/collect-logs?view=azloc-2609 | |
| Portal Send logs | Same as on-demand | Diagnostics and Remote Support → Send logs. Takes up to 30 minutes. Disabled on builds before 2510. | https://learn.microsoft.com/azure/azure-local/manage/collect-logs?view=azloc-2609 | |
| Configurator app support package | Bootstrap and Arc registration problems | Create, download (two zips: support logs and Configurator logs) or upload. | https://learn.microsoft.com/azure/azure-local/manage/troubleshoot-deployment-configurator-app?view=azloc-2609 | |
edgeMachines/jobs CollectLog | Provisioned machines | A job type with fromDate and toDate. This is an Azure write, so Sonar doesn't use it. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2025-12-01-preview/edgemachines/jobs | |
azcmagent logs | Arc agent | Writes a zip of the latest agent logs. | https://learn.microsoft.com/azure/azure-arc/servers/security-data-privacy#local-logs |
Accounts by phase and identity model
Learn does not document the file permissions on the log folders (D6). The "can read" column assumes that members of the node's local Administrators group can read them. All rows are unverified.
| Phase | Local Identity (workgroup, Key Vault) | Active Directory | Source | Verified live 10 Oct 2026 |
|---|---|---|---|---|
| Provisioning: maintenance environment (simplified provisioning) | Configurator app with the default edgeuser / Password1 | same | https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#step-2-prepare-machines | |
| Provisioning: Azure Stack HCI OS installed | The local administrator credentials given when provisioning (simplified) or set during OS setup. For Local Identity, create a non-built-in local admin with the same credentials on every node. | The local administrator, with the same credentials on every node. From version 2604 you may join the domain before deployment; if you do, add the deployment user to local Administrators. | https://learn.microsoft.com/azure/azure-local/deploy/simplified-machine-provisioning?view=azloc-2609#step-3-provision-machines-from-azure ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault?view=azloc-2609 ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-install-os?view=azloc-2609#configure-the-operating-system-using-sconfig | |
| Validation | The deployment local admin (localAdminUserName). No separate LCM user is documented for Local Identity: the Local Identity template has no AzureStackLCMAdminUsername. | The local admin. The deployment (LCM) user is a domain account. Whether it's an admin on the nodes during validation is Not on Learn, unless the nodes were joined to the domain before deployment (2604+). | https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault-template?view=azloc-2609#arm-template-parameters-reference ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609#arm-template-parameters-reference | |
| Deployment | The deployment local admin | The local admin. "During the cloud deployment of Azure Local, the LCM user account is added to the local administrator's group of the physical nodes." The nodes are joined to the domain during deployment (unless joined before). | https://learn.microsoft.com/azure/azure-local/deploy/deployment-prep-active-directory?view=azloc-2609#considerations-for-large-scale-deployments ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-install-os?view=azloc-2609#configure-the-operating-system-using-sconfig | |
| Post-deployment | The deployment local admin, which you maintain yourself. RecoveryAdmin, with its password in Key Vault. The built-in Administrator becomes ASBuiltInAdmin. RDP is off. Nodes stay in a workgroup (ADAware = 2). | The LCM user, which is in local Administrators. The local admin; if that is the built-in account, it is renamed ASBuiltInAdmin. AD users and groups only if they are added to local Administrators; Learn mentions a GPO to nest a domain group. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault?view=azloc-2609#post-deployment-steps ; https://learn.microsoft.com/azure/azure-local/concepts/security-features?view=azloc-2609#local-built-in-user-accounts ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-prep-active-directory?view=azloc-2609#considerations-for-large-scale-deployments | |
| Azure side (all phases) | Reading deploymentSettings, edgeMachines and Arc machines needs only read access in Azure. Collecting logs needs Azure Stack HCI Administrator. | same | https://learn.microsoft.com/azure/azure-local/manage/collect-logs?view=azloc-2609#prerequisites |
S-3 — Ways to reach the logs
| Method | What it needs | Limits and security | Source | Verified live 10 Oct 2026 |
|---|---|---|---|---|
| PowerShell remoting (WinRM) | Ports 5985 (HTTP) and 5986 (HTTPS). The account must be in Administrators (the default Microsoft.PowerShell endpoint) or Remote Management Users. Windows Server has remoting on by default. | WinRM encrypts traffic after authentication, even over HTTP; with NTLM the cipher is RC4-128. On public networks the default firewall rule only accepts the local subnet. | https://learn.microsoft.com/powershell/scripting/security/remoting/winrm-security?view=powershell-7.6 ; https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_remote_requirements?view=powershell-7.6 | |
| WinRM to workgroup nodes, or by IP address | NTLM is used. Put the target in the client's TrustedHosts or use HTTPS. Always pass -Credential. The account must have a password. | TrustedHosts only silences the server-identity error; it doesn't prove who the server is. Changing it needs an elevated session, so Sonar checks it and tells the user, and never sets it. For a local admin that isn't the built-in account, LocalAccountTokenFilterPolicy=1 may be needed on the target (Windows Admin Center guidance; not stated for Azure Local). | https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_remote_troubleshooting?view=powershell-7.6 ; https://learn.microsoft.com/windows/win32/winrm/installation-and-configuration-for-windows-remote-management ; https://learn.microsoft.com/windows-server/manage/windows-admin-center/support/troubleshooting#using-windows-admin-center-in-a-workgroup | |
| WinRM to domain-joined AD nodes by host name | Kerberos; no TrustedHosts needed. | Before the nodes join the domain (they join during deployment), connections fall back to the workgroup/NTLM row above. | https://learn.microsoft.com/powershell/scripting/security/remoting/winrm-security?view=powershell-7.6 | |
| CredSSP | Not needed to read local files: there's no second hop. It's off by default on both client and service. | Some Azure Local cmdlets (for example Get-AzsSecurity -PerNode/-AllNodes/-Cluster) need CredSSP or RDP; Sonar doesn't call them. | https://learn.microsoft.com/powershell/scripting/security/remoting/winrm-security?view=powershell-7.6#making-the-second-hop ; https://learn.microsoft.com/azure/azure-local/manage/manage-secure-baseline?view=azloc-2609#modify-security-settings-after-deployment | |
Arc run command (Microsoft.HybridCompute/machines/runCommands, api 2024-11-10-preview in the Learn examples) | Connected Machine agent 1.33+. Running a command needs runCommands/write (Azure Connected Machine Resource Administrator or higher); reading one needs runCommands/read (Reader). | Preview, and not in the portal. Output in instanceView is capped at the last 4 KB; route full output to append blobs. Each run is an Azure write (PUT/DELETE), which breaks Sonar's read-only goal (D8). A local azcmagent extension blocklist can block it. runAsUser needs Secondary Logon. The default run-as identity is Not on Learn. Polling a log through it means creating a new run command for every poll. | https://learn.microsoft.com/azure/azure-arc/servers/run-command ; https://learn.microsoft.com/azure/azure-arc/servers/security-extensions#allow-lists-and-block-lists | |
Arc SSH (az ssh arc, Az.Ssh) | Owner or Contributor on the Arc machine. Agent 1.31+. sshd running on the node. Microsoft.HybridConnectivity registered. A default endpoint plus an SSH service configuration (the CLI creates them on first connect). | No public IP or open inbound port needed. Windows nodes take local-user login only (Entra login is Linux only). Setup PUTs HybridConnectivity resources, which is an Azure write (D8). azcmagent config set incomingconnections.enabled false turns it off. Learn tells Local Identity deployments to "Enable SSH on each node for remote access from the Azure portal". | https://learn.microsoft.com/azure/azure-arc/servers/ssh-arc-overview ; https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault?view=azloc-2609 | |
| RDP | Turned off after deployment. Enable-ASRemoteDesktop turns it back on (through remote PowerShell). | Not a Sonar method; listed for completeness. | https://learn.microsoft.com/azure/azure-local/deploy/deploy-via-portal?view=azloc-2609#post-deployment-tasks |
Things to check in a live test (S-7)
- That
GET deploymentSettings/default?api-version=2025-09-15-previewreturnsreportedPropertieswith the shape above. Record everystatusvalue seen at the action level and the step level. - That
GET edgeMachines?api-version=2025-12-01-previewworks, and thatedgeMachines?api-version=2025-09-15-previewfails. Find which field holdsAwaitingConnection/ReadyForOs/InstallingOs. - Which files appear in
C:\CloudDeployment\LogsandC:\MASLogsduring Validate and during Deploy. Record their names, whether they rotate, and their permissions (Get-Acl). - Whether the non-built-in deployment local admin can open a
New-PSSessionby IP withTrustedHostsset, and whetherLocalAccountTokenFilterPolicyis set on the nodes. - Whether the local admin is affected at any point during or after deployment (the built-in account is renamed to
ASBuiltInAdmin). - Whether
sshdis installed and running on the nodes, which determines whether the Arc SSH fallback is usable at all.
Verified live, 10 Oct 2026 23:24Z (clus01 seed node, Deploy pass running, read over SSH as the deployment local admin)
| Item | Finding |
|---|---|
C:\CloudDeployment\Logs | Does not exist at the start of the Deploy pass (≈10 min in). Sonar re-checks it on every poll. |
| Logs written during Deploy | C:\CloudContent\MASLogs (+ ASSecurityOSConfigLogs): BareMetal_*, AzureStackOSConfig_*, WDAC_*, one file per step, timestamp in the name; C:\MASLogs: BareMetal_*, Install-LCMController_*, LCMECELiteLogs\summary.*.log.xml; C:\Observability: OSConfig\*, ObsScheduledTaskTranscripts\*, CredScanLogs\*. |
| Provisioning logs | C:\Windows\System32\Bootstrap\Logs: setup.log, arcInstallLog-*.txt, AzStackHci.ArcConnection.Debug.log\PowerShell_transcript.*, ETW *.etl. |
| Account | The non-built-in deployment local admin (Local Identity) reads all of the above. |
| Remote access | WinRM service Running, HTTP listener on all addresses; LocalAccountTokenFilterPolicy = 1; sshd running (enabled by the node preparation). |
| Validation step tree | reportedProperties.validationStatus = {status, steps[23]}, each step {name, description, fullStepIndex, startTimeUtc, endTimeUtc, status}; statuses seen Not Started, InProgress, Success; deploymentStatus = {} until Deploy starts. |
Release 12.2609 (latest): api-versions, timing and shapes, read against Microsoft Learn on 15 Oct 2026
Nothing in this section was run against a live subscription; it is Learn only. Where Learn contradicts itself, both are stated.
| Topic | What Learn says | Source |
|---|---|---|
| deploymentSettings api-versions | GA versions are 2023-08-01 ... 2024-01-01, 2024-04-01, 2025-10-01, 2026-02-01, 2026-04-30 and 2026-10-01; previews run to 2026-10-15-preview. The change log lists no property added, updated or removed after 2024-04-01 (which added operationType), so the read-only reportedProperties shape Sonar uses is the same in every version listed. Sonar defaults to 2026-10-01 and falls back once to 2025-10-01; a preview version stays configurable. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/change-log/clusters/deploymentsettings |
reportedProperties in GA | The SDK models EceReportedProperties { validationStatus, deploymentStatus } and EceActionStatus { status, steps[] } for the 2024-04-01 GA version (Az.StackHCI Api20240401, Azure.ResourceManager.Hci 1.3.0): the step tree is not preview-only. | https://learn.microsoft.com/dotnet/api/azure.resourcemanager.hci.models.ecereportedproperties |
| edgeMachines api-versions | 2025-12-01-preview ... 2026-05-01-preview, then GA 2026-10-01 (no property change from the 2026-03-01-preview shape Sonar reads); 2026-10-15-preview adds a volume setting to the target device configuration. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/change-log/edgemachines |
| Arc machines api-versions | GA 2024-07-10, 2025-01-13, 2025-06-01 and 2026-07-15 (no property change since 2025-01-13, which added identityKeyStore and tpmEkCertificate); machines/extensions has no change since 2022. Sonar reads 2026-07-15. | https://learn.microsoft.com/azure/templates/microsoft.hybridcompute/change-log/machines |
| Update resources | clusters/updateSummaries/default (state: AppliedSuccessfully, NeedsAttention, PreparationFailed, PreparationInProgress, UpdateAvailable, UpdateFailed, UpdateInProgress, Unknown; healthState, currentVersion, currentSbeVersion, healthCheckResult[]), clusters/updates (state includes Installing, Preparing, HealthChecking, Downloading, InstallationFailed, PreparationFailed, Ready, ReadyToInstall, Installed; version, rebootRequired) and clusters/updates/updateRuns (properties.progress is a recursive Step: name, status Success, Error, InProgress or Unknown status, startTimeUtc, endTimeUtc, expectedExecutionTime, errorMessage, steps[]). GA 2026-10-01; the only change since 2024-04-01 is updateRunType in 2026-10-15-preview. | https://learn.microsoft.com/azure/templates/microsoft.azurestackhci/2026-10-01/clusters/updates/updateruns |
| ARM deployment list | GET /subscriptions/{id}/resourcegroups/{rg}/providers/Microsoft.Resources/deployments/ returns properties.provisioningState, timestamp, mode; the CLI documents an OData filter provisioningState eq '{state}'. Sonar uses it for the re-run label. Which of the listed deployments belongs to Azure Local is not stated: Sonar compares the time with the last write to deploymentSettings only. | https://learn.microsoft.com/azure/azure-resource-manager/templates/deployment-history |
| Durations (ARM flow) | Validate mode takes about 10 minutes. Deploy mode: "a limited Environment Checker run, a full Environment Checker run, and cloud deployment starts"; the deployment takes 2.5 to 3 hours, several steps 40-50 minutes or more, the longest is Deploy Moc and ARB Stack (40-45 minutes). Begin cloud deployment takes 45-60 minutes (portal flow). The portal wizard and the rack aware template say validation takes about 15 minutes for one or two machines. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-azure-resource-manager-template?view=azloc-2609 |
| Identity models | Active Directory; Local Identity with Azure Key Vault (previously AD-less): one Key Vault per cluster, a non-built-in local administrator with the same credentials on every node, static IPs, SSH enabled; Internal DNS (preview) from release 2609 for Local Identity: a zone name and a zone forwarder, for cluster operations only. | https://learn.microsoft.com/azure/azure-local/deploy/deployment-local-identity-with-key-vault?view=azloc-2609 |
| Rack aware | Two racks, round trip at most 1 ms, a dedicated storage network intent, a cloud witness; clusterPattern is RackAware or Standard in DeploymentCluster (2025-10-01 and later). Learn contradicts itself on identity: the portal deployment article says a rack aware cluster can only be deployed with Active Directory ("Local identity with key vault is not supported for rack aware clusters in this release"), while the Local Identity overview lists rack aware clustering as supported. Sonar warns on the combination and does not block it. | https://learn.microsoft.com/azure/azure-local/deploy/rack-aware-cluster-deploy-portal?view=azloc-2609 |
| Disaggregated (SAN) | Separate deploy, add node and repair articles; the OS install includes connecting the SAN. The deployment, the step tree and the logs are the same as for a hyperconverged deployment as far as Learn says. | https://learn.microsoft.com/azure/azure-local/manage/repair-server-disaggregated?view=azloc-2609 |
| Add node and repair | Add-Server / Repair-Server on an existing node as the deployment user; progress with Start-MonitoringActionplanInstanceToComplete -ActionPlanInstanceID; -Rerun; validation first since release 2508; storage rebalance afterwards (days). The portal add machine flow (preview) has a Jobs pane. The REST reference has no resource for these operations that Sonar could read. | https://learn.microsoft.com/azure/azure-local/manage/add-server?view=azloc-2609 |