Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

Question

Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

Lavanya Roy 66

Hi,

I have a two-node azure local cluster but I am running into validation issues with it - This is the exact error message -

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "xxx-xxx-xxx-xxx". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace": "at Invoke-AzStackHciArcIntegrationValidation, C:\Program Files\WindowsPowerShell\Modules\AzStackHci.EnvironmentChecker\AzStackHciArcIntegration\AzStackHci.ArcIntegration.psm1: line 166\r\nat Test-AzStackHciArcIntegration, C:\Program Files\WindowsPowerShell\Modules\AzStackHci.EnvironmentChecker\AzStackHciArcIntegration\AzStackHciArcIntegration.psm1: line 136\r\nat \u003cScriptBlock\u003e, \u003cNo file\u003e: line 1\r\nat RunSingleValidator, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 878\r\nat ValidateArcIntegration, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 572\r\nat \u003cScriptBlock\u003e, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 157\r\nat Invoke-EceInterfaceInternal, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 152\r\nat \u003cScriptBlock\u003e, \u003cNo file\u003e: line 50" } at RunSingleValidator, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 898 at ValidateArcIntegration, C:\NugetStore\AzStackHci.EnvironmentChecker.Deploy.10.2505.0.2008\content\Classes\EnvironmentValidator\EnvironmentValidator.psm1: line 572 at <ScriptBlock>, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 157 at Invoke-EceInterfaceInternal, C:\CloudDeployment\ECEngine\InvokeInterfaceInternal.psm1: line 152 at <ScriptBlock>, <No file>: line 50

It fails on The evaluate interface Validate Arc integration step.

Any idea what that MSI@50342 is? cannot find it under managed identities. For now I have given the Cluster MI and the Node MIs access to the subscription but still failing.

Any help would be appreciated!

Markapuram Sudheer Reddy 2,050 Reputation points Microsoft External Staff Moderator

2025-06-04T02:51:34.87+00:00

Hi Lavanya Roy,

From above, I understand that you are performing Environment Checker to assess how ready your environment is for deploying the Azure Local solution by executing the readiness module scripts inside PowerShell on each node.

Run Get-AzConfig (as suggested in the error) to confirm your Azure CLI or PowerShell session is set to the correct subscription and tenant. This ensures that commands and scripts are targeting the right environment.

While connecting, try to execute by adding -TenantId parameter as well to your command, Connect-AzAccount -TenantId xxxx -SubscriptionId xxxx https://github.com/Azure/azure-cli/issues/5402

Managed Service Identity (MSI) specifically a system-assigned managed identity associated with your Azure resource. https://stackoverflow.com/questions/71705246/cannot-login-to-azure-with-system-assigned-managed-identity-id

Plese check here for more information.

If the information is helpful, please click on "Upvote"

If you have any queries, please do let us know, we will help you.
Tonkso 0 Reputation points

2025-06-11T14:46:17.0533333+00:00

Hi, I am getting the same error when trying to run validation, before deployment, of Azure Local. I have tried using the Azure Arc portal, or using an ARM template. Similarly this is 2 nodes. I have ran local validation tools and it passes with out issue. I have tried to clean up resource group, removing everything but the two physical ARC servers and starting again, but still get the same error.

I have checked permissions on my account, used for deployment, but I don't think it is the issue. Seems to be the managed identity referred to by MSI@50342 is missing permissions. I tried adding permissions for all managed identity within the resource group for the Azure Local deployment, but still same error.

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "--------------". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace"

Any assistance appreciated.

Thank you
Surendra Pullagura (MSC Technology North America) 0 Reputation points

2025-06-26T23:30:30.7366667+00:00

I am also getting same error

1 answer

Your answer

Markapuram Sudheer Reddy 2,050 Reputation points Microsoft External Staff Moderator

2025-06-04T02:51:34.87+00:00

Hi Lavanya Roy,

From above, I understand that you are performing Environment Checker to assess how ready your environment is for deploying the Azure Local solution by executing the readiness module scripts inside PowerShell on each node.

Run Get-AzConfig (as suggested in the error) to confirm your Azure CLI or PowerShell session is set to the correct subscription and tenant. This ensures that commands and scripts are targeting the right environment.

While connecting, try to execute by adding -TenantId parameter as well to your command, Connect-AzAccount -TenantId xxxx -SubscriptionId xxxx https://github.com/Azure/azure-cli/issues/5402

Managed Service Identity (MSI) specifically a system-assigned managed identity associated with your Azure resource. https://stackoverflow.com/questions/71705246/cannot-login-to-azure-with-system-assigned-managed-identity-id

Plese check here for more information.

If the information is helpful, please click on "Upvote"

If you have any queries, please do let us know, we will help you.
Tonkso 0 Reputation points

2025-06-11T14:46:17.0533333+00:00

Hi, I am getting the same error when trying to run validation, before deployment, of Azure Local. I have tried using the Azure Arc portal, or using an ARM template. Similarly this is 2 nodes. I have ran local validation tools and it passes with out issue. I have tried to clean up resource group, removing everything but the two physical ARC servers and starting again, but still get the same error.

I have checked permissions on my account, used for deployment, but I don't think it is the issue. Seems to be the managed identity referred to by MSI@50342 is missing permissions. I tried adding permissions for all managed identity within the resource group for the Azure Local deployment, but still same error.

Type 'ValidateArcIntegration' of Role 'EnvironmentValidator' raised an exception: { "ExceptionType": "text", "ErrorMessage": "The provided account MSI@50342 does not have access to subscription ID "--------------". Please try logging in with different credentials or a different subscription ID. If a subscription is not specified, please check the configs by Get-AzConfig.", "ExceptionStackTrace"

Any assistance appreciated.

Thank you
Surendra Pullagura (MSC Technology North America) 0 Reputation points

2025-06-26T23:30:30.7366667+00:00

I am also getting same error

Answer 1

Pieter Teeling 10

The issue is the version of the az.accounts powershell module. If you're running anything but 4.0.2, you'll run into this scenario.
Start by checking the version of the module (Get-InstalledModule -Name Az.Accounts) and see if you're running 4.0.2 or anything else.

If you have 4.0.2 and other versions, delete the rest (without notification)
Get-InstalledModule -Name Az.Accounts -AllVersions -ErrorAction SilentlyContinue | Where-Object { $.Version -ne '4.0.2' } | ForEach-Object { Uninstall-Module -Name $.Name -RequiredVersion $_.Version -Force -ErrorAction SilentlyContinue }.

If 4.0.2 is missing:
Install-Module -Name Az.Accounts -RequiredVersion "4.0.2" -Force -AllowClobber -SkipPublisherCheck

Do this on all your nodes/machines.

Doing this will make the Azure Stack HCI Arc Integration step during the cluster validation of Azure Local continue without the errors you've seen before.

Pieter Teeling 10 Reputation points

2025-06-13T18:49:38.6133333+00:00

you may also have to check Az.Resources PowerShell module and make sure that's the 7.8.0 version
Tonkso 0 Reputation points

2025-06-16T11:50:21.7033333+00:00

Thank you very much Pieter!

This indeed was the answer and my cluster has now passed the validation stage.
I did not notice your other comment about Az.Resources until now, so at the time I ran with version 6.0.1 of that module (as it complained about version 8)
For anyone else with this issue, this was the windows build and modules I used:

WindowsProductName Azure Stack HCI
WindowsVersion 2009
OsBuildNumber 26100

Powershell modules installed:
Az.Accounts 4.0.2
Az.ConnectedMachine 1.1.1
Az.Resources 6.0.1
Az.Storage 8.1.0
PackageManagement 1.4.8.1
PowerShellGet 2.2.5
GabeCz 1 Reputation point

2025-06-30T11:39:15.0233333+00:00

validation passes with az.resources and az.accounts version mentioned above but deployment fails. unfortunately i did not take a note where it failed at first try with these versions. but upgrading them at or before joining the domain while deploying will result in the "MSI@50342" error. leaving it be will fail at a later step.

trusting that a system will work fine in a production environment without safety net that cannot be set up in a lab environment to test and learn is very difficult if not impossible.

Share via

Azure Local Cluster Validation failing at Evaluate interface ValidateArcIntegration step

1 answer

Your answer