Register your Azure Stack HCI cluster with reduced permissions

Published Tuesday, June 7, 2022

We are happy to announce several improvements to the HCI cluster registration experience. These improvements are based on community feedback and survey results.

Relaxed permission requirements at both Azure Tenant and subscription level: As a user registering the cluster, now you don’t need any privileges at the tenant-level, we have also reduced the permissions at the subscription level, hence reducing the impact in case of any security breach or user error.

Azure Permissions	Previously	Now
Tenant Level	"microsoft.directory/applications/createAsOwner", "microsoft.directory/applications/delete", "microsoft.directory/applications/standard/read", "microsoft.directory/applications/credentials/update", "microsoft.directory/applications/permissions/update", "microsoft.directory/servicePrincipals/appRoleAssignedTo/update", "microsoft.directory/servicePrincipals/appRoleAssignedTo/read", "microsoft.directory/servicePrincipals/appRoleAssignments/read", "microsoft.directory/servicePrincipals/createAsOwner", "microsoft.directory/servicePrincipals/credentials/update", "microsoft.directory/servicePrincipals/permissions/update", "microsoft.directory/servicePrincipals/standard/read", "microsoft.directory/servicePrincipals/managePermissionGrantsForAll.AzSHCI-registration-consent-policy"	Not Required
Subscription Level	"Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.Resources/subscriptions/resourceGroups/write", "Microsoft.Resources/subscriptions/resourceGroups/delete", "Microsoft.AzureStackHCI/register/action", "Microsoft.AzureStackHCI/Unregister/Action", "Microsoft.AzureStackHCI/clusters/*", "Microsoft.Authorization/roleAssignments/write", "Microsoft.HybridCompute/register/action", "Microsoft.GuestConfiguration/register/action", "Microsoft.HybridConnectivity/register/action"	"Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.AzureStackHCI/register/action", "Microsoft.AzureStackHCI/Unregister/Action", "Microsoft.AzureStackHCI/clusters/*", "Microsoft.Authorization/roleAssignments/write", "Microsoft.HybridCompute/register/action", "Microsoft.GuestConfiguration/register/action", "Microsoft.HybridConnectivity/register/action"

More flexibility with resource group creation: Previously we only allowed the user to specify the resource group for HCI cluster resource, but now you can also specify the resource group information for the Arc for server resources.

For more detailed information, please see our documentation: Connect Azure Stack HCI to Azure - Azure Stack HCI | Microsoft Docs

We hope these registration improvements will make your registration experience smoother, quicker, and more productive. We are always open to feedback; you can comment on this blog or reach out to me directly.

Future Plans

We plan to improve this workflow further by providing: